Start a recovery

You reach recovery from several places:

• Forgot password?, in the footer of the password screen.
• Recover your account, on the Sign-in was refused screen.
• I lost my passkey, a link under the buttons on the second step. It opens this page with the address you typed already in Email address. The address travels in the part of the web address after the #, which is never sent to a server or logged; the page reads it once and then removes it from the address bar. Above the form the page says Recovery for an account with a passkey or an authenticator app is held for 24 hours, and every address on the account is told when it starts.
• Recover your account, after you choose No, secure my account on the page from a sign-in alert email.
• The recovery address directly.

If you are already signed in on this browser, the recovery page is not needed and takes you to your account instead.

The page is titled Recover your account and says Enter the email address of the account. If it exists, we will send a message with the next step.

The footer link Back to sign in returns you to the sign-in page.

1. The Email address field.
2. I have a recovery code, which opens an optional field.
3. Send recovery message.

The answer is the same whatever you typed. It is the same for an address with an account and one without, and the same whether or not a recovery code you typed matched. The page never confirms that a message was sent, because that would tell a stranger which addresses have accounts. Everything that differs happens by email, and only to the verified addresses of an account that exists. If the address is yours and no message comes, look in your junk folder and wait a few minutes before you ask again.

The mail limits apply here too, and they do not depend on whether the account exists: only a limited number of messages go to one address in a short while, and the whole service has a daily allowance. When one is reached the page says so (We have already sent the most emails allowed to this address for now. or We have reached the limit for sending email today, so no message can be sent right now.), with Why does this happen? and a Reference: code. See Sign in with an emailed link or code.

An account that an organization manages has no password or other credential of its own to recover, so recovery sends nothing for it, and the page still answers the same way. Ask the organization's administrators for help instead.

A recovery code is one of the single use codes you saved when you turned on an authenticator app. Entering one here is optional. You do not need one to recover. If you type a code and it does not match, nothing on the page changes, but the owner of the account is told by email that a code was not accepted.

A request can be refused for coming too often, with the message Too many attempts. Wait a little and try again. A refused request answers with status 429 and a Retry-After header, and where the wait is known the page says Too many attempts. Try again in a length of time, in minutes once it is a minute or more. Slow down and try again later.

The recovery email explains what arrives and what to do with it.