The recovery model

How account recovery works from your side: what you can do when you cannot sign in, what protects the account while you do it, and what happens when you finish.

On this page

Account recovery is for the day you cannot sign in: you forgot the password, lost the device that held your passkey, or lost your authenticator app. It has to be possible, or people lose accounts. It also has to be safe, because anything that lets you in without your usual methods can let someone else in.

Identity's answer is to offer the strongest way available to you and to make the weaker ways slow and visible.

Start with what you still have#

Before recovery, try the ways in that are not recovery.

Another passkey. If you have a second passkey, a security key or a synced passkey on another device, use it. That is an ordinary sign-in.
An emailed link. On the sign-in page, Email me a sign-in link can get you in where your organization allows it, for an account that has no passkey. See Authentication methods.
Your password. A correct password always signs you in, even if you lost your passkey or authenticator app: on a browser the account knows it is enough, and on a new one you can Continue with my password only (limited session) and confirm later with another method. See The second step.
The lost-passkey code. If a passkey is your only second step and you know your password, the second step offers Email me a code instead. See The second step.
A recovery code. Where your organization allows it, if you saved your recovery codes, one of them takes the place of your authenticator app. See Security and passkeys.

If none of these are available, use recovery.

The recovery path#

On the sign-in page, select Forgot password? or Recover your account. The page is titled Recover your account. Enter the email address of the account and select Send recovery message.
The page says If that account exists, a message is on its way. Follow the link in it. It says that whether or not the address has an account, so it never tells anyone which addresses do.
Open the link in the message. It is valid for 15 minutes (an operator can shorten that, not lengthen it), works once, and works only in the browser that asked for it. The page, titled Continue recovery, says Opening this page changes nothing. Only the button below continues. Select Continue recovery.
A waiting period can apply, so recovery may not finish at once. For an account with a passkey or an authenticator app it is 24 hours by default, and the sign-in's I lost my passkey link opens the recovery page with your address filled in and says so. The page says Recovery is on hold until a given time, and the hold notice shows when it ends. Identity waits before anything changes.
When recovery is open, you reach Secure your account, a limited session that lets you set new sign-in methods. Review each one, then select Finish recovery.

If you opened the link in a different browser than the one you started in, it does not work: the page says This link only works in the browser where you started the recovery. Open it there, or start the recovery again in this browser., with a link, Why does this happen, and what do I do?, to The recovery waiting period. This is deliberate: a link that works anywhere is a link someone else could use.

While you wait, the account is watched#

The wait is not idle time. It exists so the real owner can notice.

Every verified email address on the account gets a message that a recovery is on hold, with a one-click cancel link.
An open session in the account sees a pending-recovery notice with a cancel button on the Security page.
If you did not ask for the recovery, the message says If this was not you, cancel it now. and has a Cancel recovery button. On the Continue recovery page the same choice is the link Cancel the recovery under Did you not ask for this?. The cancel page says Cancel a recovery of your account that you did not ask for. Cancelling ends the recovery request, and the account is untouched.
Once the hold ends, ask for recovery again from the same browser.

If you started the recovery yourself, be patient while it is on hold. Cancelling by mistake only means starting again.

What the limited session can do#

The session you get from recovery is deliberately small. It is at assurance level 1 and is confined to the Security area until you have set a sign-in method. On Secure your account you can:

Save a new password. Every account needs one, so recovery cannot finish without it.
Set up a new authenticator app, scan its key, enter the code to confirm it, and receive new Recovery codes. Each code works once. Save them somewhere safe.
Add a passkey, with Add a passkey. Adding one is a change like the others: it ends the other sessions and re-issues this limited session. The passkey is new, so Finish does not ask you to confirm it.
Remove passkeys you no longer control. The page says No passkeys are registered. when there are none.
Remove the authenticator app that was set up before.

Finish recovery is refused until the account has a password: Set a password before finishing. A passkey alone no longer finishes recovery. It is also refused if an authenticator app from before the recovery is still set up and you have not either removed it or said I still have the authenticator app that was set up before, and I want to keep it. The same holds for a passkey from before the recovery: remove it, or tick I recognise these passkeys and want to keep them. A passkey added during the recovery is new and is labelled (added in recovery), so you can tell it from the ones you had.

What happens when you finish#

The page says Recovery is finished. Sign in with your new details. Finishing is a clean break.

Every session ends, including the one you just used, and the cookie is cleared. You sign in again with the method you set up.
Applications that registered for back-channel logout are told. Refresh tokens from earlier sessions stop working. See Sessions.
Trusted devices drop back to recognised. A device you trusted under the old credentials cannot keep that trust. See Trusted devices.
A security alert is emailed for each change you made during recovery, such as a new password, a new authenticator app, a new passkey or a removed passkey. See Notifications.

What recovery is not#

It is not a way around an organization's rules. After you sign in again, the organization's own limits apply as usual.
It is not available for an account that an organization manages: such an account has no credential of its own to recover, so the page gives the same answer and no message is sent. Ask the organization's administrators.
It does not reveal whether an address has an account. The messages are worded the same either way.
It is not always instant, by design. If the delay worries you, set up a second passkey and keep recovery codes before you need them.