Finish recovery

Finishing is checked before anything happens. The account must have a password (a passkey alone no longer finishes recovery), and any authenticator app or passkey that was set up before the recovery began must either be removed or be marked as one you still hold or recognise. If all of that holds, identity:

• ends every session on the account, including the limited one you are using, and signs this browser out, which is why you must sign in again;
• tries to send a security alert to each verified email address on the account, saying that account recovery finished (a failure to send does not stop the recovery from finishing). See Security alert emails.

Nothing you set on Secure your account is undone. The password, authenticator app and passkeys you left in place are the ones you sign in with next.

If the page refuses, it says why. Set a password before finishing. means the account has no password, and An authenticator app from before the recovery is still set up. Remove it, or say you still have it. means an old app is still active. A passkey from before the recovery is still on the account. Remove any you do not recognise, or say you recognise them. means a passkey that was there before the recovery is still listed. Fix the section it points at and select Finish recovery again.

Select Sign in and sign in with your new details. Use the new password, or a passkey you kept (the account always has a password too). If you set up an authenticator app, use it when the sign-in asks for a second step. See Sign in with a password.

1. Your devices. Open Devices in your account. Recovery treats the account as possibly taken over. When it granted you the limited session, it ended every earlier session and revoked your personal access tokens, and a device you had marked as trusted became Recognised until you trust it again. Look for sessions or devices you do not know, and create any personal access token you still need again. See Sessions and devices.
2. Your passkeys and authenticator app. Make sure only things you control are listed. See Security and passkeys.
3. Your recovery codes. If you made a new authenticator app, keep the codes shown on the recovery page.
4. Your email. Recovery trusts your mailbox, so if you think someone had access to it, secure it first.

If you did not do this recovery, see Cancel a recovery. If a recovery you did not start has finished, treat the account as compromised: sign in, change your password, remove passkeys you do not recognise, and use Sign out everywhere.

• Sign in with a password
• Sessions and devices
• Sign-in errors and what they mean