Start with your email provider's recovery process

The fastest way to regain access is through your email provider's built-in recovery tool. Gmail, Outlook, Yahoo, and most other services have a dedicated "Forgot password?" or "Can't access your account?" link on their login page. Click that link and the provider will walk you through steps to verify you own the account — usually by sending a code to a backup email address or phone number you set up earlier.

This process works because email providers store recovery information separately from your password. Even if you cannot remember your password, you can still prove ownership through a phone number, backup email, or security questions you answered when you created the account. The provider then lets you set a new password without needing the old one.

If you set up two-factor authentication (a second verification step when you log in), you will need access to that second method — usually a phone that receives text codes or an authenticator app. If you no longer have that phone or app, most providers have a backup code option you should have saved when you first turned on two-factor authentication.

Key Takeaways

  • Your email provider's "Forgot password?" link is the official recovery method and works even if you remember nothing about your account.
  • Recovery relies on backup contact information you provided when creating the account — a phone number, backup email, or security questions.
  • If you set up two-factor authentication, you will need the phone or app that receives codes, or a backup code you saved at setup.
  • Account recovery usually takes minutes if you have access to your backup phone or email, but can take days if you need to verify your identity another way.
  • Once you regain access, write down your new password somewhere safe and update your recovery information so you do not get locked out again.

What to do if your backup phone or email is no longer active

If the phone number or backup email you registered with no longer works, the provider cannot send you a recovery code. At this point, you will need to verify your identity through other means. Most providers offer a form where you answer security questions, provide the date you created the account, or describe devices you used to log in from.

Some providers, like Google, will ask you to enter the last password you remember, even if it is incorrect. They use this to confirm you are the person who set the account up. Others may ask for a phone number associated with your account, a credit card you used to make purchases, or the approximate date you last accessed the account.

This verification process can take anywhere from a few minutes to several days depending on how much information you can provide and how busy the provider's support team is. During this time, your account remains locked. If the provider cannot verify your identity, they may deny the recovery request, though you can usually try again with different information.

Recovering passwords for accounts linked to your email

Once you regain access to your email, you can use it to recover passwords for other accounts — bank websites, social media, shopping sites, and anything else that uses that email address to log in. Most websites have a "Forgot password?" link that sends a reset code to your email inbox.

Go through each account you use and reset the password to something new and strong. This is important because if someone gained access to your email, they may have also tried to log into your other accounts. Changing passwords prevents them from using old credentials to get back in.

As you reset each password, consider using a password manager — a tool that stores passwords securely so you only have to remember one master password. Password managers like Bitwarden, 1Password, or Dashlane generate strong passwords and fill them in automatically, which makes it much harder to forget them again.

Setting up recovery information so this does not happen again

After you regain access, spend a few minutes updating your recovery settings. Log into your email account's security or account settings page. Most providers have a section called "Recovery options," "Security," or "Account recovery."

Add or update a backup email address — ideally one you use regularly and have access to. Add a phone number where you can receive text messages. If your provider offers security questions, answer them with information only you would know. Some providers also let you save backup codes — a list of one-time codes you can use if you lose access to your phone or backup email. Write these codes down and store them somewhere safe, like a locked drawer or a password manager.

The goal is to have at least two ways to prove you own the account. If your phone gets lost, your backup email still works. If you forget your backup email password, your phone can still receive a code. This redundancy means you are far less likely to get locked out permanently.

When you cannot remember the email address itself

If you cannot remember which email address you used to create an account on a website or service, recovery becomes much harder. The website cannot send you a reset code if it does not know which email to send it to.

Try logging in with email addresses you think you might have used — a work email, a personal email, an old email you may have forgotten about. Many people have multiple email accounts and use different ones for different purposes. If you have an old phone or computer, check the browser history or saved passwords to see which email you used.

If you have a receipt or confirmation email from the service in your current email inbox, that email address will be listed in the message. Search your inbox for the service name or look through old emails from around the time you created the account. If you still cannot find it, contact the service's support team directly — they can sometimes tell you which email is associated with your account if you provide other identifying information like your name or a phone number.

Using a password manager to prevent future lockouts

A password manager stores your passwords in an encrypted vault that you access with one strong master password. When you need to log into an account, the password manager fills in your username and password automatically. This means you never have to remember individual passwords, and you can use long, random passwords that are much harder to guess or crack.

Popular password managers include Bitwarden (free and paid versions), 1Password, Dashlane, and LastPass. Most work across phones, tablets, and computers, so your passwords are available wherever you log in. They also generate new strong passwords for you when you create accounts, which takes the guesswork out of password security.

The trade-off is that you must remember your master password — the one password that unlocks all the others. Write it down and store it somewhere very safe, like a locked box at home or with a trusted family member. If you forget your master password, you cannot access your vault, so this is the one password worth the extra effort to remember or find.

What to do if you think someone else accessed your account

If you regain access to your email and notice suspicious activity — emails you did not send, contacts you do not recognize, or forwarding rules you did not set up — someone may have had access to your account. Take these steps when ready.

Change your password to something completely new and very strong. Check your recovery settings and make sure the backup email and phone number are still yours — attackers sometimes change these to lock you out. Look at your account activity or login history (most providers show recent logins and devices) and sign out any sessions you do not recognize. If your email was used to send spam or phishing messages, notify your contacts that your account was compromised so they do not click malicious links.

Consider running a malware scan on your computer or phone using antivirus software like Windows Defender (built into Windows), Malwarebytes, or Norton. If your password was weak or you reused it across multiple accounts, change passwords on your bank, email, and any financial accounts as soon as possible. If you see fraudulent charges or suspect identity theft, contact your bank and consider placing a fraud alert with the credit bureaus.

Frequently Asked Questions

How long does email recovery usually take?

If you have access to your backup phone or email, recovery takes minutes — you receive a code, enter it, and set a new password. If you need to verify your identity through security questions or other means, it can take hours to a few days depending on how much information you can provide and how quickly the provider responds.

Can I recover my email if I do not remember any recovery information?

It becomes much harder, but not impossible. Contact your email provider's support team directly and provide as much identifying information as you can — your name, approximate account creation date, devices you used, or payment information. The provider may ask you to verify your identity through a video call or other method before granting access.

What if my backup email was hacked too?

Recover your backup email first using its own recovery process, then use it to recover your primary email. If both accounts are compromised, contact each provider's support team separately and explain the situation. They have additional verification methods for cases where multiple accounts are affected.

Do I need to change passwords for all my other accounts after recovering my email?

Yes. If someone had access to your email, they could have used it to reset passwords on your bank, social media, and shopping accounts. Change passwords on any account that matters — especially financial accounts, email, and social media — to prevent unauthorized access.

Is it safe to write down my password?

Writing down a password and storing it in a locked drawer at home is safer than reusing the same weak password across multiple accounts or forgetting it and getting locked out. A password manager is even safer because it encrypts your passwords. Never write down passwords on sticky notes at your desk or take photos of them on your phone.