Facebook Code Generator Gone? Log In Without Your 2FA Phone

You type your Facebook password on a new phone, and Facebook asks for a six-digit code. The old phone with the Code Generator or your authenticator app is lost, broken or wiped, and the code screen seems to go nowhere.

The short answer: you can often still get in. Facebook has a set order of fallbacks for exactly this, and an identity check for when all of them fail. Work through them in order and do not hand a code to anyone along the way.

This guide is for owners who lost their own second factor. It covers what happened to Code Generator, each fallback in order, the identity check, the scams aimed at people stuck on this screen, and how to set up two-factor authentication so a lost phone does not lock you out again.

Last checked: 5 October 2026.

#How Do You Log In to Facebook If You Lost Your Two-Factor Phone?

Facebook's two-factor troubleshooting page tells you to try these in order. First, wait a few minutes in case the SMS code is delayed. Second, check Facebook on any other phone, tablet or browser that is still logged in, because you may be able to approve the new login there without a code. Third, enter one of your saved recovery codes. If none of those work, go back to the code screen and choose "Need another way to authenticate?" (on a computer), "Having trouble?" (Android) or "Need help?" (iPhone or iPad) to ask Facebook to confirm your identity. Facebook reviews that request and decides. Nobody outside Meta, including AwareXone, can switch off the check for you.

#What Happened to Facebook Code Generator?

Code Generator was a feature inside the Facebook app that showed a rotating login code. It only worked if you were already logged in on that phone, so it disappeared with the phone. In 2023 Meta began telling remaining users to switch methods, and its head of security policy told Social Media Today that Meta was "sunsetting" the older approach to move people to stronger methods.

Facebook's current page on how two-factor authentication works lists three methods: a security key, codes from a third-party authentication app, or SMS codes. Code Generator is not among them. If an old guide tells you to open "Code Generator" in the menu, it is out of date. What you probably need now is the app you moved to, the phone number on the account, or a recovery code.

#Which Second Factor Did You Lose? A Quick Diagnosis

Your route depends on what is gone and what you still have. Match your situation to a row before you tap anything. Exact button wording can vary by app version, language and region.

#Step 1: Wait for the SMS Code and Check Your Number

If text messages were one of your methods, the code may simply be slow. Facebook says carrier delays happen and suggests checking again after a few minutes, making sure you have signal and that your message inbox is not full.

• Request one code, then wait. Repeated requests can make it harder to tell which code is current.
• If you lost the phone but kept the number, ask your carrier for a replacement SIM on the same number. Expect to prove the line is yours, so ask what to bring before you go.
• If a prepaid line has expired, the number may no longer be yours, and SMS codes will not reach you. Move straight to the other fallbacks.
• If codes stop arriving while your phone suddenly shows "No service", call your carrier from another phone and ask whether your SIM was replaced without your consent.

For codes that never arrive at all, our guide to a Facebook login code that is not coming through goes deeper into SMS and email delivery.

#Step 2: Approve the Login From a Device Still Logged In

Look around before you give up. An old laptop, a family tablet, a work computer or a browser you have not logged out of may still hold your session. Facebook's page on getting a security code says you can approve a login attempt from a device it already recognises.

1. Start the login on your new phone and leave it on the code screen.
2. On the other device, open Facebook and check your notifications.
3. Approve the login only if the time and device match what you are doing right now.
4. Once in, go straight to two-factor settings and add a new method before anything else.

Facebook also notes that a browser you previously saved may not ask for a code at all, unless private browsing or automatic history clearing has wiped it. Trying from your usual home computer is worth a minute.

#Step 3: Use One of Your 10 Recovery Codes

Recovery codes are single-use backup codes. Facebook's page on login recovery codes says you get 10 of them once two-factor authentication is on, and each can stand in for an authenticator code once.

• Search where people usually keep them: a printout in a drawer, a password manager, a note on a computer, a photo in cloud storage.
• Type the code on the two-factor screen exactly as written.
• Cross off each code you use, because it will not work again.
• Once you are in, click "Get new codes" in Accounts Center to replace the set. Facebook says you can request new ones if you run out or lose them.

#Step 4: "Need Another Way to Authenticate?" and the Identity Check

When none of the fallbacks work, Facebook offers an identity check. Its troubleshooting page describes how to start it from the same screen that asks for the code:

• On a computer: click "Need another way to authenticate?", then "Other Options", then "Get more help".
• On Android or a mobile browser: tap "Having trouble?".
• On iPhone or iPad: tap "Need help?".

What Facebook asks for next depends on the account. At the time of writing, it may ask you to upload a photo of a government-issued ID, such as a MyKad, driving licence or passport, answer questions about the account, or confirm your identity through trusted contacts you set up earlier. Facebook then reviews the request and replies through the email address or phone number on the account, so keep those inboxes open.

If Facebook rejects your ID or the upload keeps failing, see our guide to a rejected Facebook ID confirmation before you try again. Facebook makes the final call, and some requests are not approved.

#Mistakes That Make a Lost-Code Lockout Worse

• Resetting the phone you still have before checking whether it holds a Facebook session or an authenticator backup.
• Uninstalling the authenticator app on the old phone "to start fresh" while it still works.
• Starting the identity check in Facebook Lite, where it is not available.
• Uploading a blurry, cropped or expired ID, or a name that does not match the profile.
• Opening a new account to message Meta, which leaves your real account exactly where it was.
• Sharing the login screen, a code or a recovery code with someone who promises to fix it.

#Is It a Lost Code or a Hacked Account?

A lost factor is your own phone gone missing. A takeover looks different: password changed, a new email on the account, posts you did not make, or two-factor switched on by someone else. Facebook's page on recovering an account you cannot log in to says to visit facebook.com/hacked on a device you have used to log in before if you suspect a hack. Our guide to a hacker turning on two-factor covers that case, and if the email and phone are both gone too, read recovering without the old email, phone or 2FA.

#Scams Aimed at People Stuck on the Code Screen

People searching for help with a lost code are a target. The pitch arrives in comments, direct messages and Telegram groups, in English, Bahasa Malaysia or Chinese: someone promises to "bypass 2FA" or "remove the code" and asks for your password, a login code or a photo of your recovery codes. Others pose as Meta support. A real helper cannot do any of this, because the only ways past the code screen are the ones above.

• Anyone asking for a login code, an OTP or any of your 10 recovery codes is trying to take the account.
• Nobody can switch off Facebook's two-factor check from outside, whatever they charge.
• Ignore "Meta support" accounts that reach out in comments or from a personal profile; start every step from the Facebook app or facebook.com yourself.
• Legitimate help starts with a case review, uses only Facebook's own processes, works on a best-effort basis, and is honest that Facebook decides and some accounts do not come back.

If you already paid a scammer or sent a code that led to a bank or e-wallet loss, the government's NSRC 997 page says to call 997 within 24 hours of discovering the scam, contact your bank and make a police report at the nearest station. A fake login page or phishing link can also be reported to CyberSecurity Malaysia's Cyber999, which helps Malaysian users escalate abuse reports.

#Once You Are Back In: Set Up 2FA So This Never Happens Again

Facebook only lets you add or change two-factor methods once you are logged in, its authentication app page notes. Do this before you close the app. The path is Settings and privacy, Settings, Accounts Center, Password and security, Two-factor authentication.

1. Add an authentication app on your new phone, scan the setup code, and enter the code it generates.
2. Add a second method as well, such as SMS on a number you will keep for years.
3. Get a fresh set of 10 recovery codes and store them offline: printed, or in a password manager that is not only on your phone.
4. Consider a security key. Facebook's security key page calls it one of the best ways to protect an account, and says to register a second key or another method so losing one key does not lock you out.
5. Remove the lost phone from your logged-in devices in Accounts Center.
6. Check that the email and phone number on the account are current.

#When a Case Review Makes Sense

Many owners can work through the steps above alone, and only Facebook can restore access. A second opinion helps when the identity check keeps failing, when the account runs your business or ads, or when you cannot tell whether you lost a factor or were hacked. SocialSafe by AwareXone, our recovery service, looks at the case first and tells you honestly whether an official route is still open; sometimes the answer is that you already have what you need. You can read how we handle Facebook account recovery, and our Trust Center sets out what we never ask for, starting with your password and your codes.

#Frequently Asked Questions