Lost 2FA for Proton Mail: Recovery Codes, Keys, and Resets

hard ⏱ 20–45 minutes Updated 2026-08-18

Official Proton page for this problem: proton.me — we link it because the official flow is always the real path; this guide exists to help you get through it.

Losing your 2FA device for Proton Mail feels like being locked out of your own vault, but there are several exits before the worst-case one. Proton deliberately designed 2FA so that its own staff cannot switch it off for you — which is good security and bad news when the phone is at the bottom of a lake. The escape routes, in order of preference: your 2FA recovery codes, a second enrolled factor, restoring your authenticator app, and finally a password reset. That last one carries Proton’s signature caveat: because of end-to-end encryption, a password reset without a recovery phrase or recovery file restores the account but permanently locks your existing emails. Getting in and keeping your data are separate outcomes here — this guide keeps them separate too.

Before you start

Search for any of the following before touching the reset flow. Each one you find improves your outcome.

• 2FA recovery codes — the one-time codes Proton showed when you enabled 2FA and told you to save. Check your password manager, downloads folder, printed papers, and note apps.
• A second factor — a hardware security key, or 2FA enrolled on another device (a tablet, an old phone in a drawer).
• Your old phone or an authenticator backup — many authenticator apps (Aegis, 2FAS, Google Authenticator with account sync, etc.) back up or transfer their entries. A restored backup restores the Proton code.
• Your Proton recovery phrase (12 words) and/or a recovery file — these decide whether a password reset preserves your data.
• Your recovery email or phone number — needed for the reset path.
• Your account password itself — every option below still requires it.

Step 1: Confirm what you’re missing

Go to account.proton.me, enter your username and password. If the password works and you’re stopped only at the 2FA prompt, you’re in the right guide. (If the password itself fails, that’s a lockout — a different problem with a different guide.)

Step 2: Use a recovery code at the 2FA prompt

At the two-factor prompt, Proton lets you substitute a recovery code for the authenticator code — look for a link or option such as using a recovery code instead (Proton may word it slightly differently). Enter one of your saved one-time codes. Each code works once.

Once you’re in, go immediately to Settings → Security → Two-factor authentication: remove the lost authenticator, enroll a new one on your current phone, and generate a fresh set of recovery codes (using a recovery code typically invalidates the old set). Save the new codes in your password manager. Done — no data was ever at risk on this path.

Step 3: Use any other enrolled factor

If you registered a hardware security key alongside the authenticator app, use it at the prompt. If you had the authenticator on a second device, use that. After signing in, clean up: remove lost factors, add current ones, regenerate recovery codes.

Also try restoring your authenticator app’s own backup on a new phone before giving up on this step — for many people the “lost” 2FA is sitting in an app backup they forgot about.

Step 4: The password reset path — read this before clicking

With no codes and no working factor, the remaining supported route is Proton’s password reset, which also disables 2FA on the account. This is where data loss can happen, so choose your entrance deliberately:

• You have your recovery phrase: use “Forgot password?” and recover with the phrase. This resets the password, clears the 2FA barrier, and — because the phrase is a data recovery method — your existing emails remain readable. This is the good version of the reset.
• You only have a recovery email or phone: the reset will restore account access, but Proton will warn you that existing data will be locked. That warning is literal: your old mail becomes unreadable unless you later supply the old password, a recovery phrase, or a recovery file that existed before the reset. Since you presumably still know your password (only the 2FA is lost), note it down carefully before resetting — after the reset, that old password becomes your key to unlocking the old data via Settings → Recovery. This detail turns a would-be data loss into a mere inconvenience, so don’t skip it.
• You have no recovery method at all: Proton cannot reset the account for you. Support can verify some account-level facts but cannot bypass 2FA or decrypt anything; without a recovery method, there is no supported way back in. See the final section.

After any reset: sign in, go to Settings → Recovery to unlock old data if needed (recovery phrase, recovery file, or old password), then re-enable 2FA properly and store the new recovery codes.

Step 5: Re-secure the account for next time

Once you’re back in: enroll 2FA on your primary device and a second factor (hardware key or second device), store recovery codes in a password manager, confirm a recovery email or phone is set, write down your recovery phrase somewhere offline, and download a current recovery file. Losing 2FA should never be more than a ten-minute annoyance again.

What NOT to do

• Don’t pay anyone to “bypass” Proton 2FA. Proton’s end-to-end encryption and authentication design make third-party recovery outright impossible — no service can remove your 2FA or decrypt your mailbox. Every operation advertising this is a scam or a phishing operation.
• Never share your recovery phrase, recovery codes, or password with anyone, including people claiming to be Proton support. Proton staff will never ask for them; anyone who does is an attacker.
• Don’t rush the password reset. Resetting via recovery email without first securing your recovery phrase — or at minimum writing down your current password for post-reset data unlock — is how people convert a lost phone into a lost decade of email.
• Don’t uninstall or wipe the old authenticator app anywhere it might still exist (old phone, backup) until new 2FA is fully working.

If nothing works

If you have no recovery codes, no second factor, no authenticator backup, and no recovery method for a reset, the honest answer is that the account is closed to you. Proton cannot make an exception: its support staff cannot disable 2FA on trust, and its encryption means the mailbox contents cannot be produced by anyone — that inflexibility is the same property that protects the account from attackers.

What remains is starting over: create a new account, and in the first ten minutes save the recovery phrase, download a recovery file, add a recovery email, enable 2FA, and store the recovery codes. Then migrate — update the email address on your important services, tell your contacts, and set a calendar reminder to verify your recovery setup once a year. If the old address was tied to critical accounts, change those accounts’ login emails promptly so their password resets no longer flow into a mailbox nobody can open.

recover.email is not affiliated with Proton. This guide is informational and cannot guarantee recovery.