Lost your Steam authenticator?

Reviewed 12 September 2026 by MASTERPANEL LLC 3 min read Sources and testing: Recovery routes checked against Valve's current Steam Guard guidance; no undocumented bypass or support duration is asserted Editorial method

A dead phone, a wiped machine, a deleted folder. This page is the order to try things in, based on what you still have. If you suspect theft rather than device loss, start with the compromised-account steps from a trusted device; restoring a leaked secret will not make it safe again.

Account recovery happens through Steam's own site or app. A surviving local backup can also restore desktop authenticator data. No third-party tool can reconstruct a missing strong secret from an account name or bypass Steam's ownership checks. Do not upload maFiles or pay a stranger promising to unlock the account.

1. Is there a copy of the secret anywhere?#

Look for a backup containing the authenticator that is still active on Steam:

A .maFile in an old SDA folder, or in a backup of one.
The same folder on a machine you still have — an old laptop, a drive you kept. Encrypted ones also need manifest.json and the original encryption passphrase.
An ODA vault or per-account recovery file, with the passphrase that encrypted that file. See ODA's recovery-file instructions.

If you find one, import it somewhere you control and confirm it produces codes Steam accepts before you rely on it.

Being signed in does not prove that a device holds the authenticator. Check the Steam Mobile app's Steam Guard screen for a working code or recovery code before signing out or reinstalling it. An existing session may help you access account settings, but it does not guarantee that Steam will let you replace the authenticator without further verification.

2. Is a phone number still linked to the account?#

If you can receive messages at that number, you may not need the recovery code. Valve's own instructions say that when you no longer have access to your authenticator, you can choose "I no longer have access to my authenticator" at the sign-in confirmation and transfer it to a new device using an SMS code sent to that number. Follow the app's prompts; a linked number you cannot access is not an available SMS recovery route.

3. Do you have unused Steam backup codes?#

A previously generated backup code can replace a generated Steam Guard code at sign-in. It does not replace the password, recover the authenticator secret or guarantee a transfer. Once signed in, follow Steam's account-recovery prompts.

4. Do you have the revocation code?#

It looks like R12345 and was shown when the authenticator was first added. With it, you can remove the authenticator yourself from Steam's help pages, then set a new one up. Use Steam's help site and follow the lost-authenticator prompts; the checks depend on your account.

Removing the authenticator puts a hold on trading and the Market for a period. That is Steam's rule, not something a tool can shorten — anything advertising otherwise is a scam.

5. No recovery code and no phone number#

Then it is Steam Support, through a help request to remove the authenticator. Follow the evidence requests in your ticket. Steam's ownership guidance covers historical payment evidence and activated product codes; account names, public profile details and guesses about creation dates do not establish ownership. Provide requested evidence only through the official help site. We cannot promise a response time or recovery outcome.

Only Valve can change Steam's account-access decision. A third-party service cannot guarantee recovery, and handing it credentials creates another exposure.

Making sure this does not happen again#

Write the revocation code on paper. Not in the same place as the maFile, and not only on the machine that holds it.
Keep an offline copy of the secret somewhere encrypted that is not the computer you use every day.
Test the backup once. An untested backup is a belief, not a backup.

This is the reasoning behind two decisions in our own application: a recovery file is created during enrollment or transfer, and it is kept when an account is removed locally. Resolve any recovery-write warning before relying on that file, keep the passphrase used when it was created, and copy it off the daily-use disk.