How to recover your password





Account Recovery Walk-Through

This section will document the step-by-step process of doing a recovery for several of the most common cases. This will give one some idea of what to expect going through the process. But note that as Google makes changes to the process or the individual pages the images below may become out-of-date. It's a guide to the general process, not definitive documentation. Still, it should help guide one through the process.

The overall flow of the walk-through will cover the following cases (click the link to jump to that topic):
All account access starts the same way, by going to the Gmail sign in page at: https://mail.google.com/. If you're trying to recover access to an account, you click the "Can't access your account?" link at the bottom.  Note that the link may also simple be "Help".
This starts the recovery process with the initial choices where you select the type of problem you are having.
The choice you make starts you down one of several branches towards account recovery.

Another way to do the same basic task is to use this help article where you can select the particular account access problem you are having.  But note that several of the choices end up at the same location as the above "Can't access your account?"

  • I don't know my password

    If you have forgotten your password this is the path you will use. One example of how this could happen is if a browser is configured to automatically fill in the login details and for some reason the information is lost. This path may not work for a compromised account as hackers will often change the recovery details to try and prevent the original owner from regaining access to the account.  Enter your account name and click Continue


    Depending on what recovery options were configured for the account, several options may appear. Select the one you wish to use and click Continue.


    If Google identifies a security issue, it may not offer some of the pre-configure recovery options which may require one to use the account recovery form (verify your identity) described below.

    Be aware that many of the paths below will require solving a Captcha verification before proceeding. It doesn't mean anything is wrong, so just enter the letters and click Continue.




    • Get a verification code on my phone

      The option most preferred by Google is for them to send you a verification code to a pre-configured mobile device. When this option is selected a choice of receiving the code by SMS message or voice is given. Make the selection and click Continue.


      Do not leave the recovery process until you receive the code. The code will be received on the configured mobile device and should be entered on the next screen that will be presented.


      Once the code is entered, the next screen will allow the creation of a new password for the account.



    • Confirm access to my recovery email

      This option is perhaps the simplest as it just sends an e-mail to a pre-configured recovery e-mail address allowing one to reset the account password. Select the option and click Continue.


      There will be a notification that a password reset was sent to your pre-configured recovery e-mail address.

      When received, the e-mail will look similar to this.


      Click the enclosed link and follow the instructions to create a new password.



    • Answer my security question

      Another choice may be to answer a pre-configured secret (security) question. This is a legacy recovery method as new accounts no longer provide this option.  It also appears that even for accounts that have a security question, it may no longer be offered.  So it is not an error if you configured a secret question and are not offered that as a recovery option.


      If answered correctly the next screen will allow the creation of a new password for the account.



    • Verify your identity - The Account Recovery Form

      It's possible that none of the above options will work. Perhaps the settings were changed by a hacker who compromised the account. Perhaps they were never configured, or the information has gone out-of-date (the recovery address no longer exists or you have changed your mobile number). In this case, the final option is the Account Recovery Form which is accessed by the link at the bottom: "Verify your identity".

      Details of this process appear below.

      This will lead to a series of screens that ask a number of details about the account which if answered correctly will prove ownership and allow the password to be reset. The first two screen look similar to the following.



      Once the form as been submitted there will be a confirmation screen.


      There are three possible results.

      1. Success - a link will be provided to reset the password
        Congratulations...
      2. Failure - insufficient information has been provided to prove ownership. The only option is to keep trying.
        At Google, we take your privacy and security seriously. We're committed to returning accounts only when we're sure we're giving them back to the accounts' owners. Unfortunately, based on the information you provided, we were unable to verify that you own this account. To ensure that we are not compromising the security of the data, we can't return the account at this time.
      3. Additional help offer - an offer for prioritized (paid) support may be presented.  Note:  based on user reports, this option may no longer be offered.  It's optional so you may ignore it and continue to use the other provided options. There may be more than one form of response e-mail, but one form is as follows:
        We received your request to recover your Google Account xxxxxxxxxx@gmail.com, and we’d like to evaluate your account more closely. To continue the account recovery process, please visit: [long URL link]

        You will need to be signed out of all Google/GMail accounts to use the link. Following that link will lead to a long page that starts like this:

        [page continues...]


        As it states, this path is totally optional, if you don't wish to use it simply follow the link to re-submit, or return to the start of the recovery process to try a different path.



  • I don't know my username

    This is the selection to use if you have forgotten the username for the account. This can also sometimes happen if a browser or mobile device is configured to automatically sign in every time, or for an account that is rarely used. But this will only work if a recovery e-mail address was previously configured for the account.

    • Forgot your username

      You need to know the recovery address you used for this account, and that address should be entered at this point. There will also be a Captcha to solve before submitting the request.

      If the information is correctly entered above, the next screen will confirm that an e-mail was sent to the recovery address with a list of all Google usernames associated with that e-mail.


      When received, the e-mail will look something like this, and may contain a list of multiple e-mail addresses. Once you know the username, you may have to return to the start of the recovery flow to recover the password if that was also forgotten.


  • I'm having other problems signing in

    This is a catch-all for any problem not covered by the above choices (although it includes the above also). Enter the e-mail address and click Continue.


    You will be directed to the following help page which presents a list of options each of which expands into more options and directs you to a specific solution. A few of the options (I forgot my password, or I forgot my username) will direct you back to the above page for recovery.





  • Special situations

    There are a couple special cases that deviate from the above recovery flow.  So if these cases apply, be aware that it will change what is seen during process.

    • Two-step verification

      Accounts that have two-step verification enabled will require a verification code at some point during the recovery process. If an access code can not be obtained for any reason, one of the alternate options must be selected, which will probably require the use of the Account Recovery Form to regain access.

      The final option ("I didn't enable 2-step verification") can happen if an account is compromised and the hacker enables two-step verification in an attempt to lock-out the rightful owner. Selecting that option will lead to the Account Recovery Form to recover from this case.


      If the first option above is selected and Continue is clicked, a code will be received on the designated mobile device which is entered on the next screen.


    • Google Apps accounts

      Google Apps accounts (those not ending in @gmail.com) can not be recovered using the standard Gmail recovery procedures. One must contact the Google Apps administrator who can reset the password to regain access.

No comments:

Post a Comment

Subscribe to: Comments (Atom)