On this page
A forgotten password and a lost 2FA device need completely different recovery paths: a password resets by email, entirely self-service, while a lost authenticator with no backup codes requires your organisation's owner to reset it for you. Neither one risks your data or your role in the organisation.
Symptom
Either the login screen rejects a password with no way to proceed, or, for an account with two-factor authentication turned on, the code entry screen after a correct password rejects every code entered because the authenticator app that generates them, and any saved backup codes, are no longer accessible (a lost or reset phone, an uninstalled authenticator app, misplaced backup codes).
Why it happens
A forgotten password is the ordinary case any account system handles: the account exists and is otherwise fine, only the specific credential is not known. Two-factor authentication recovery is more deliberately restrictive by design, since 2FA exists specifically to stop someone else from accessing the account even with the correct password, so a self-service reset of it, which would defeat that protection entirely, is intentionally not offered from the login screen at all. Instead, resetting a locked-out teammate's 2FA is placed with the organisation's owner, who already holds the highest level of trust in the account, and the action is both audit-logged and emailed to the affected member automatically, so it cannot happen quietly.
Fix
For a forgotten password:
- From the login screen, select Forgot password.
- Enter the email address associated with the account and submit; a reset link is emailed if an account with a password exists for that address.
- If no email arrives within a few minutes, check spam, and confirm the account was not created via Google sign-in only, since an OAuth-only account has no password to reset and should be accessed through Google sign-in instead.
- Follow the link to set a new password, then sign in normally.
For a lost 2FA device with no backup codes:
- Contact your organisation's owner and ask them to reset your 2FA.
- The owner opens Settings, then Team, finds your row, and selects Reset 2FA. This is only available to the owner role (or a super admin), not to other roles regardless of permissions.
- You will receive an email automatically confirming the reset, naming who performed it.
- Sign in again using just your password. With 2FA cleared, no code is required.
- Re-enroll in two-factor authentication if you want it active again, generating a new authenticator secret and a fresh set of backup codes; see turn on two-factor authentication for the setup steps.
- Save the new backup codes somewhere durable this time, a password manager or a printed copy kept securely, specifically to avoid needing this recovery path again.
If you are the organisation's owner and lose your own 2FA device:
- You cannot reset your own 2FA, and no other owner in the organisation can reset it for you.
- Contact support directly, since an owner's 2FA is treated as the organisation's root of trust and its reset is handled outside the normal in-app flow for that reason.
How VGraple CRM handles it automatically
A password reset link is single-use and time-limited, and the forgot-password endpoint always returns the same success response regardless of whether the submitted email matches a real account, specifically so the flow cannot be used to discover which email addresses have accounts. Sign-in attempts are rate-limited both by IP address and, separately, per specific 2FA challenge, capping incorrect code guesses at five before that particular sign-in attempt is invalidated and has to be restarted, a deliberate defence against brute-forcing a six-digit code. An owner resetting a member's 2FA is blocked entirely from resetting another owner's 2FA or their own from that same screen, and every reset is written to the organisation's audit log and emailed to the affected member the moment it happens, so the action is never silent or invisible to the person it affects.
Example
A sales agent at a real-estate agency loses their phone, including their authenticator app, and has never saved their backup codes. They message the agency's owner, who opens Settings, then Team, finds the agent's row, and selects Reset 2FA. The agent receives an automatic email confirming the reset happened, signs back in with just their password, and re-enrolls in 2FA on their new phone that same day, this time saving the new backup codes to their password manager.
Prevention
Save backup codes somewhere durable and separate from the device running the authenticator app itself the moment two-factor authentication is turned on, a password manager entry or a securely stored printed copy, specifically so a lost or replaced phone does not become a lockout at all. For an organisation's owner specifically, since no one else can reset an owner's 2FA, it is worth being especially careful with backup codes for that account, or maintaining a second trusted authentication method where the underlying app supports it. Reviewing the audit log periodically also surfaces any 2FA reset that happened, expected or not, as part of the organisation's normal security hygiene.
Is there a way to disable 2FA entirely for the organisation instead of resetting individuals?
Two-factor authentication is enrolled and controlled per user, not enforced or disabled at the organisation level as a single switch, so each teammate's 2FA status is independent of everyone else's. This means a lost-device situation for one teammate never affects anyone else's ability to sign in, and there is no organisation-wide 2FA toggle to accidentally weaken security for the whole team while trying to fix one person's access. See roles and permissions reference for how the owner role's specific abilities, including 2FA reset, fit into the broader permission structure.