How to recover your Login.gov account

Login.gov describes itself as a way to sign in to many US government websites with one account, and it is provided by Technology Transformation Services within the General Services Administration. The account consists of an email address, a password and at least one second authentication method. Nothing else about you lives there unless you have separately completed identity verification, in which case a verified name, date of birth, address and Social Security number are held in encrypted form so that participating agencies can be told you are who you say you are.

The agencies named on Login.gov's own help pages give you the shape of the estate: the Internal Revenue Service, Medicare.gov, the Social Security Administration, Trusted Traveler Programs, OPM Retirement Services Online and the System for Award Management. Login.gov's public overview also names USAJOBS and Global Entry. Individual agencies join and leave the service over time, so the list you meet in practice is longer than any single published page.

The boundary matters more than the list. Login.gov states that the account 'is for account access and sign in only' and 'does not affect or have any information related to the specific agency you are trying to access.' Creating, deleting or recreating a Login.gov account does not touch your benefit record, your tax account, your Known Traveler Number or your job applications. It does not restart a membership and it does not make you pay a program fee again.

That cuts both ways. Because the credential holds nothing, Login.gov support cannot tell you why a payment has not arrived, whether an application was approved, or what a letter from an agency means. Its own SSA page is blunt about it: your Login.gov account 'does not affect or have any information about your Social Security card, number, or benefits,' and Login.gov 'can only answer questions about the sign-in process and creating a Login.gov account.'

The same page structure repeats for the IRS and for Trusted Traveler Programs. Login.gov will help with account creation, sign-in, multi-factor authentication and passwords. Anything about tax, eligibility, application status, appointments or a lost Global Entry card goes to the agency. Knowing which side of that line your problem falls on saves you the most common wasted hour in this whole process — queuing for the wrong help desk.

One more structural point. Some agencies accept more than one credential provider. The Social Security Administration, for example, accepts both Login.gov and ID.me. If you have both, you can be signed in to the right service under the wrong credential and see a record that looks empty or unfamiliar. That is not a lockout, and the fix is to sign out completely and come back through the other provider.

Failure one is the password. The symptom is that the email and password screen rejects you, or that you no longer remember which email address you used. This is the easiest to fix and the fix is on the sign-in page itself. It becomes hard only in one specific case — when you no longer control the email address on the account.

Failure two is the second factor. The symptom is that the password is accepted and you land on a screen asking for a one-time code, an authenticator code, a security key touch or a backup code that you cannot produce. The phone is gone, the app did not migrate, the key is in a drawer in another state. This is the most common real-world lockout and it has a genuine dead end at the bottom of it.

Failure three is identity verification. The symptom is different: you can sign in perfectly well, but the service will not accept your driver's license photo, cannot match your Social Security number and personal details, or refuses to send a code to your phone number as part of proofing. Then it stops letting you try at all. This is a six-hour lock, not a permanent one, and it has an in-person alternative.

Failure four is the agency link. The symptom is that the Login.gov side works — you get a green tick, you are signed in, you can see your account page — but the agency behind it shows nothing, shows the wrong person, or bounces you back with an error of its own. Login.gov support cannot help with this at all, because the failure is on the other side of the handoff.

There is a fifth thing that is not a lockout and gets mistaken for one. If you see a message that a security check failed, that is Login.gov's reCAPTCHA refusing to be convinced you are human. Login.gov's guidance is to try the same device and browser you used to create the account, turn off VPNs and ad blockers, clear the browser cache, update the browser, and try again at a different time or in another browser. A corporate VPN is by far the most common cause.

Before you do anything else, check the service is actually up. Login.gov publishes a status page, and a degraded authentication service produces symptoms that look exactly like a personal account problem. Ten minutes spent confirming the platform is healthy is cheaper than a delete-and-recreate cycle you did not need.

Once you know which failure you have, go straight to the matching section below. The order of the sections matches the order of the failures, and the last one — the agency link — carries the my Social Security case, which is the single most searched version of this whole problem.

Start with the screen you are already on. Sign in with your email address and password, and when the authentication page appears, select 'Choose another security option.' That link is the whole game. If you set up more than one method at any point — a second phone, an authenticator app, a set of backup codes, a security key, face or touch unlock, or a government employee PIV or CAC card — it is listed there, and you are back in within a minute.

If the missing factor is a phone number you can still recover, recover the number first. Login.gov's guidance for a lost phone is explicit that regaining access to the original number is the cleanest route, because a one-time code sent to a restored number authenticates you without any further ceremony. A carrier can often reissue a SIM on the same number the same day, which is faster than every alternative on this page.

If codes are simply not arriving, work through the mundane causes before assuming a lockout. Login.gov advises waiting up to ten minutes and using the resend button, checking the device is on and out of airplane mode, and — for a landline — choosing the phone-call option rather than a text. It also warns that a number with an extension will not work at all, because one-time codes cannot be delivered to extensions. If you opted out of text messages from the service, you can only opt back in 30 days after the opt-out date, so switch methods rather than wait.

If the missing factor is an authenticator app, the failure is usually clock drift rather than anything to do with your account. Login.gov's guidance is that the time may not be synced between your device and the app, and that problems generating a code should go to the app's developer, not to Login.gov. Set the phone clock to network time, and try again. If the app itself is gone because the handset was wiped, the codes are gone with it — an authenticator seed does not survive a device reset unless the app was set to back it up.

Backup codes behave in a way that catches people out. Login.gov issues ten of them, each usable once, and generates a fresh list when you have used all ten. That regeneration happens quietly during a sign-in, which means the list saved in your password manager two years ago may already be spent. Login.gov's own page on the subject says that if you forgot to print or copy your codes, you will need to delete and recreate the account — with the important caveat that having another method set up is what keeps you out of that position.

A security key is the most robust method and the least forgiving one. There is no reset for a lost key. If it was your only method, you are on the delete-and-recreate path. If you use one, keep a second key or a set of backup codes, and treat the pair as one unit — the point of a hardware key is that nobody, including the service operator, can bypass it.

The dead end is stated in Login.gov's own words on its authentication-problems page: 'If you cannot sign in with your only authentication method, you will have to delete your account and create a new account,' and 'For security purposes, Login.gov cannot unlock your account for you or sign in on your behalf.' There is no escalation above that, no supervisor, and no documentary proof you can send in. Read the delete-and-recreate section before you act on it.

Once you are back in, add a second method immediately. Login.gov recommends at least two, and the account page has a menu for adding them. The combination that survives most real disasters is an authenticator app on the phone plus a printed set of backup codes kept somewhere physical — because those two fail for different reasons.

The password reset is ordinary. From the sign-in page, select 'Forgot your password?', enter the email address on the account, open the message that arrives, follow the reset link and set a new password of at least twelve characters. Nothing about this step requires your second factor, which is why people sometimes reset a password and then discover the real problem is one screen further on.

If you have verified your identity, the reset has a second half that surprises people. Login.gov's guidance is that after resetting your password you must reactivate your profile using your personal key — a code issued when you verified your identity, which encrypts the verified information held against your account. The system asks for your most recent personal key, and Login.gov notes that if you have reset your password before, you may have a new one.

Personal keys are single use and are replaced each time one is consumed. They can be viewed, copied, downloaded or printed from your account page while you still have access, which is precisely when nobody thinks to do it. If you cannot produce one at a reset, you do not lose the account — you lose the verified profile attached to it, and you will be asked to verify your identity again the next time an agency needs proofing.

The email address is the harder failure. Login.gov's page on email and password problems states that if you do not have access to your account email and do not remember your password, you need to create a new account with an email address you do control and re-verify your personal information. There is no route that recovers a credential anchored to a mailbox you cannot open.

If you still have access to the mailbox but have simply forgotten which address you used, try the reset flow against every address you have ever used for government business, including old work addresses. The reset page does not confirm whether an address exists, so this is a matter of checking inboxes rather than reading error messages. Also check spam and quarantine folders — reset mail from a government domain is caught by filters more often than you would expect.

A related trap is the shared or delegated mailbox. Accounts created by a family member, a tax preparer or an office administrator on your behalf are anchored to their email, and they, not you, control recovery. If that is your situation, the honest answer is to create your own account under your own address rather than trying to prise the old one loose.

Finally, if you suspect the account was taken over rather than merely lost, treat it as a security incident rather than a recovery problem. Login.gov's guidance is to change your password and contact the service, and it directs claims of identity theft or fraudulent use of your information to IdentityTheft.gov and the FTC on 1-877-438-4338, to the FBI's Internet Crime Complaint Center for cybercrime, and to the HHS Office of Inspector General hotline on 1-800-447-8477 for fraud against federal programs. Login.gov states it cannot investigate fraud involving other agencies or services.

Login.gov applies rate limits rather than permanent bans, which is the good news buried in a frustrating screen. Its help page lists three sign-in locks, all of ten minutes: entering the password incorrectly too many times, requesting too many security codes in a period, and entering the security code incorrectly too many times. In each case the instruction is the same — wait ten minutes and try again — and the password lock can also be short-circuited by resetting the password.

The identity-verification lock is different in both duration and consequence. Login.gov limits the number of times you can attempt to verify your ID, your personal information or your phone number online, and the wait is six hours. Its published handbook is more specific: five tries within six hours for document capture, five within six hours for the personal-information and Social Security number check, and five within six hours for phone verification. Attempts count whether they succeed or fail.

The handbook also records limits people meet without realizing what they have hit. Ten one-time codes inside ten minutes triggers a ten-minute lockout. Verify-by-mail letters are capped at four requests in 30 days with at least 24 hours between them. And the Social Security number check has a system-wide throttle as well as a per-user one, which is why a verification attempt can fail in a way that has nothing to do with your details at all.

When a six-hour lock expires, do not create a new account. Login.gov's instruction is to go back to the partner agency website you were trying to reach, sign in with your existing email address, password and authentication method, and start verification again from there. A second account does not reset anything useful and leaves you with two credentials pointing at the same services.

Use the six hours rather than resenting them. The most common cause of repeated failure is document capture — glare on the license, a cropped edge, a shadow across the state seal, or a card in a plastic sleeve. Take the photographs again in flat, indirect daylight on a dark, plain surface, with the card out of any holder and the whole document inside the frame. Check the personal details you typed against the document itself, character by character, including middle initials and suffixes.

Rate limits are also a fraud control, which is why they are not negotiable and why nobody can lift them for you. The service cannot distinguish between an unlucky citizen with a worn license and an attacker cycling stolen identities, so it applies the same ceiling to both. This is the mechanical reason the contact center cannot help — there is no override to apply.

If you are locked out at a moment that matters — an application window, a filing deadline, an enrollment period — deal with the deadline separately from the lockout. Almost every agency that uses Login.gov has a paper or telephone channel that does not require an online account, and using it does not prejudice anything you do online afterwards.

Verification is a separate stage from signing in, and only some agencies require it. Login.gov's overview sets out what you need: a US driver's license, state ID or passport book or card; your Social Security number; and a US phone number or mailing address. The flow is four steps — photograph the ID and sometimes take a selfie, enter your personal details for checking against public and proprietary databases, confirm a phone number by one-time code, and re-enter your password to link the verified profile to the agency.

Each of those steps fails for its own reason. Document capture fails on image quality and on IDs the system cannot read. The personal-information check fails when your name, date of birth or address do not match the records the databases hold — which is common after a recent move, a marriage, a divorce or a legal name change, and common for people with thin files. Phone verification fails when the number is not associated with you in commercial data, which affects prepaid numbers, family plans held in someone else's name and recently ported numbers particularly hard.

The alternative to the phone step is verification by mail. Login.gov sends a letter to your address with a code you enter to complete the process. It is slow, and the handbook caps it at four requests in any 30 days with at least a day between them, so treat each letter as something to wait for rather than something to reorder.

The alternative to the whole photo step is a Post Office. If uploading images does not work, Login.gov offers in-person verification at participating US Post Offices. You complete what you can online, Login.gov emails you a barcode, and you take that barcode — printed or on your phone — along with the same ID you entered online to the counter. The retail associate scans the barcode and checks the document.

Two timings matter there. The barcode expires seven days after you verify your information online, and if it lapses you have to start again to get a new one. After the visit, Login.gov emails the result within 24 hours, so do not expect confirmation at the counter. Take the physical ID you used online, not a different one — a mismatch between what you typed and what you present is a wasted trip.

If none of it works, the escalation is not to Login.gov. Its own verification guidance says that if you do not have the required documentation, you should contact the agency you are trying to access to find out what you can do instead. Federal agencies that require identity proofing are generally obliged to offer a route for people who cannot complete it online, and that route is usually an office appointment or a paper process. Ask the agency for it by name.

It is also worth stopping to ask whether you need verification at all. Many agency functions — checking a case status, filing a form, making a payment — do not require a proofed identity, and some do not require an account at all. If the only reason you are grinding through verification is to see one number, call the agency and ask whether it can tell you that number over the phone.

If you have lost every authentication method, deletion is the documented route back, and it is initiated from the screen you are stuck on rather than from a support ticket. Go to secure.login.gov or your agency's sign-in page, enter your email address and password, and on the authentication screen choose 'Choose another security option.' Scroll to the bottom of that list and select the link about deleting your account. Read what it tells you, then confirm.

The clock then starts. Login.gov sends two emails: one immediately confirming that it has received the request, and a second 24 hours later with instructions to complete the deletion. The delay is deliberate — it gives the real account holder a window to intervene if somebody else has started the process. You cannot shorten it, and there is no expedited path.

What gets destroyed is narrow. Login.gov says it deletes your email address, password and phone number. What survives is the part people actually worry about: 'you won't lose your information saved with partner agencies, but you will need to create a new Login.gov account' to reach those services again. Your Social Security record, your tax account, your Known Traveler Number and your job applications are unaffected, because they were never inside the credential.

The cost is the verified profile. If you had completed identity proofing, you will have to complete it again on the new account, with the same documents and the same rate limits. Budget for that rather than being surprised by it, especially if verification was difficult the first time — and consider going straight to the Post Office route on the second attempt if the online capture defeated you before.

You can reuse the same email address, but not immediately: Login.gov requires you to wait 24 hours after deletion before creating an account with the same address. If you need access sooner than that and you have a second email address you control, use it — nothing about your agency records is tied to which address you sign in with.

Build the new account differently. Add at least two authentication methods before you leave the setup screens, which is Login.gov's own recommendation, and make them fail in different ways: an authenticator app plus printed backup codes, or a security key plus a phone number. Store the backup codes somewhere physical, and if you complete identity verification, download the personal key at the moment it is offered.

One last piece of hygiene. If you use the 'remember this browser' option, understand what it is doing — it suppresses the second-factor prompt on that browser for up to 30 days, which means you can go a month without touching your authentication method and only discover it is broken when the reprieve expires. Sign in from a private window occasionally to confirm the method still works while you are still in a position to fix it.

The most common version of this is Social Security, because the sign-in arrangements changed underneath tens of millions of people. Login.gov's SSA page states the rule directly: if you created a Social Security username more than three years ago, you need to transition to a new or existing Login.gov account to keep continuous access to SSA online services. The old agency-issued username is not a credential you can recover — it is a credential that has been retired.

If you already have a Login.gov account for another purpose, use it rather than creating a second one. The transition links an existing credential to your existing my Social Security record; it does not create a new Social Security record and it does not change your benefit. SSA also accepts ID.me, so if you verified with ID.me for the IRS or a state unemployment system, that credential may already work — and if you hold both, be sure which one you signed in with before concluding your record has vanished.

The most alarming symptom in this category is signing in successfully and seeing nothing, or seeing someone else's details, or being told your identity cannot be matched. That is a mismatch between the identity attached to the credential and the identity on the agency record — most often a name that differs by a middle name, a suffix or a married surname, or a date of birth keyed wrongly years ago. Neither Login.gov nor ID.me can fix it, because the record is SSA's.

Fix it at the agency. SSA's number is 1-800-772-1213, with TTY on 1-800-325-0778, and Login.gov's SSA page gives its hours as 8:00 a.m. to 7:00 p.m., Monday to Friday. A correction to your name or date of birth on the Social Security record is an ordinary agency transaction requiring evidence — a birth certificate, a marriage certificate, a court order — and once the record is corrected the online sign-in generally starts working without any further action on the credential.

Say this out loud to yourself before you panic: a locked online account does not stop a payment. The online account is a window onto a record, not the record itself, and it is not the mechanism by which benefits are paid. Login.gov's own SSA page says the account 'does not affect or have any information about your Social Security card, number, or benefits.' Deposits continue, notices continue to arrive by mail, and nothing about being locked out changes an entitlement.

The same logic applies across the estate, with different phone numbers. For anything about tax, the IRS handles it and Login.gov's IRS page points you to the agency's own help pages rather than the sign-in service. For Trusted Traveler Programs, CBP handles applications, interviews, memberships and replacement cards through the portal at ttp.cbp.dhs.gov, and Login.gov confirms that creating an account does not change your Known Traveler Number or make you pay a program fee again.

When the agency's own site is what is broken — an error after the handoff, a page that will not load, a form that will not submit — that is an agency IT problem and its help desk owns it. Login.gov's help-with-agencies overview draws the line the same way every time: it can help you create an account, sign in, manage authentication and reset a password, and the agency handles everything you actually came to do.

If you genuinely cannot resolve it with either side, the Login.gov contact center is on (844) 875-6446, 24 hours a day, seven days a week, and there is a web contact form. Be realistic about what it can do. Its own page says staff cannot sign in, create, delete or manage your account on your behalf, and cannot help with application status, membership, eligibility, benefits or agency account concerns. Login.gov also asks you not to share your address, phone number, Social Security number or other identifying information when you contact it.