I lost my phone
Use a backup code or another enrolled method to sign in, then remove the old authenticator and set up 2FA again on your new device.
AltF Authenticator
Lost the phone with your authenticator app
Sign in with a backup code or another method you enrolled, such as a security key, a second phone or a passkey. If you have none, use each service's account recovery process, which can take days. Once you are back in, remove the old authenticator, set up 2FA again and save new backup codes.
- Free, no sign-up
- Secrets stay in your browser
- RFC 6238 self-test built in
- Works on mobile
First hour
- If the phone was stolen, use your phone maker's find-my-device service to lock or erase it.
- Call your mobile carrier to block the SIM, so nobody can receive your SMS codes.
- Start with your main email account, because it can reset most other accounts.
Ways back in, in order
- Backup codes you saved when you set up 2FA.
- Another enrolled method: a second phone, a security key, a passkey on another device, or SMS to a number you still control.
- Cloud sync in your authenticator app, if you had it turned on. Some apps can restore accounts after you sign in on a new phone.
- A saved copy of the secret or setup QR in a password manager. If you have one, add it in the Live codes tab to get a code right now.
- The service's account recovery form. Give as much detail as you can and expect a waiting period.
After you are back in
- Remove the old authenticator from each account's security settings.
- Set up 2FA again on your new device. This creates a new secret.
- Generate and store a new set of backup codes. The old set may have been on the lost phone.
- Add a second method, such as a security key or passkey, so one lost device is not enough to lock you out again.
What no tool can do
Codes come from the secret. Without the secret, a backup code or the service's help, nobody can make valid codes for your account, and any site that claims to is a scam.
Lost the phone with your authenticator app: questions and answers
Can I recover Google Authenticator codes without the old phone?
Only if you had cloud sync turned on in Google Authenticator, or saved the secrets somewhere else. Otherwise use backup codes or each service's recovery process.
Can AltF Authenticator recover my codes?
Only if you still have the secret or the setup QR code. It cannot make codes from nothing.
How do I avoid this next time?
Save backup codes offline, enrol a second method, and keep a copy of each secret in a password manager or an authenticator with encrypted backup.
Start from what happened
My codes are being rejected
Check your device clock first. If it is right, verify the code against the secret to see whether it matches a nearby time step.
I am moving to a new phone
Export from the old app, import on the new one, and check every account works before you wipe the old phone.
I am adding 2FA to my own app
Generate a secret, show it as an otpauth:// QR code, and test your server's verification against the RFC vectors.
I need to keep backup codes safe
Store recovery codes offline, away from the phone that holds your authenticator, and mark each one as used.
I want to check my authenticator is right
Add the same secret here and compare codes, or run the RFC self-test to confirm the maths on this device.
Authenticator tools and 2FA guides
All authenticator toolsThe full studio: live codes, setup, verify, HOTP, export decoder, backup codes, clock check and self-test.TOTP code generatorGenerate TOTP 2FA codes from a Base32 secret, otpauth:// link or QR image. SHA-1, SHA-256 or SHA-512, 6 or 8 digits, calculated in your browser.otpauth QR code generatorBuild an otpauth:// URI with issuer, account, algorithm, digits and period, and draw the 2FA setup QR code in your browser. Free, nothing uploaded.TOTP secret key generatorGenerate a random 160-bit Base32 TOTP secret with your browser's secure random number generator, plus the otpauth link and QR code. Nothing is sent.TOTP code verifierCheck whether a 2FA code matches a secret within a window of time steps, and see which step matched and the clock drift that implies. Runs in your browser.HOTP generatorGenerate HOTP counter-based one-time passwords per RFC 4226 from a Base32 secret and any counter value. Includes the RFC test values. Runs in your browser.Google Authenticator export decoderDecode a Google Authenticator Export accounts QR (otpauth-migration://) into standard otpauth links and secrets, locally in your browser. Nothing uploaded.2FA backup codesGenerate random recovery codes, download or print them, and learn where to store your real 2FA backup codes so a lost phone does not lock you out.2FA code not workingWhy your authenticator code is rejected and how to fix it: check your device clock, the secret, the account and non-default settings. Free clock check.RFC 6238 test vectorsThe 18 RFC 6238 Appendix B TOTP test vectors for SHA-1, SHA-256 and SHA-512, with seeds, times and expected 8-digit codes, run live in your browser.
Guides
What is TOTP?What TOTP is, how authenticator apps make 6-digit codes from a secret and the time, how it compares with SMS and passkeys, and what it protects against.SMS vs authenticator appSMS codes, authenticator apps, passkeys and security keys compared: what each protects against, the risks of SIM swap and phishing, and what to choose.
AltFTool never receives your secrets or codes. The only network request any tab makes is the clock check, which asks AltFTool's server for the time and carries nothing else.