Short answer
First look for anything you saved: backup or recovery codes, an old phone that still has the authenticator app, a device that is still logged in, or an authenticator that syncs to the cloud. On Instagram and Facebook, choose Try another way on the code screen and follow the identity steps — Instagram’s backup codes can only be viewed while you are logged in. On Google, use Try another way and your recovery options. Once you are back in, set up two methods and keep backup codes offline.
Why people get locked out
- A new phone, without moving the authenticator app across.
- A changed or lost phone number, so SMS codes never arrive.
- A deleted authenticator app or a factory reset.
- Backup codes that were never saved.
Check what you still have
- Backup codes in a password manager, a notes app, an email to yourself or on paper.
- The old phone — even without a SIM, the authenticator app still generates codes.
- Any phone, tablet or browser that is still logged in.
- A cloud-synced authenticator or a password manager that stores one-time codes.
Instagram and Facebook
- On the code screen, tap Try another way to see the other methods set up on the account — SMS, WhatsApp, email or backup codes, depending on what you configured.
- If none work, follow the identity steps; Instagram may offer a video selfie when the account has photos of you.
- Try from a device you have logged in with before — recognised devices help.
- Once in, generate new backup codes: Accounts Center → Password and security → Two-factor authentication → Additional methods → Backup codes.
On the 2-Step Verification screen, choose Try another way to use a backup code, a security key, a prompt on a signed-in phone or your recovery phone or email. If none are available, go through account recovery from a familiar device and location — see our Google account guide.
Never get locked out again
- Set up at least two methods — for example an authenticator app and a security key or passkey.
- Print or store backup codes somewhere you can reach without your phone.
- Use an authenticator that backs up to the cloud, or move it before you wipe an old phone.
- Update your phone number on every account before you change SIM.
Frequently asked questions
Can Instagram turn off two-factor authentication for me?
Not on request. You regain access through the alternative methods or the identity steps, then manage two-factor authentication yourself.
Where are my Instagram backup codes?
In Accounts Center → Password and security → Two-factor authentication → Additional methods → Backup codes. You must be logged in to view them or get new ones.
I changed my phone number. How do I get the code?
Use another method you set up — an authenticator, backup codes or a recognised device — then update the number once you are in.
Is SMS two-factor authentication safe enough?
It is much better than none, but authenticator apps, passkeys and security keys resist SIM-swap attacks better.
Sources: Instagram Help Center — two-factor authentication, Instagram Help Center — backup codes, Google Account Help — account recovery