I do not have a backup code

Not having a backup code is not a dead end. A backup code is only one of the ways to prove that it is really you. If you do not have one, choosing "I do not have a backup code" simply opens the other methods available on your account.

How recovery works

Recovery takes three steps. First you enter the old email or phone number (identify), then you prove that it is you (prove), and finally you replace the lost factor with a new one (replace). You are not just resetting a password: you set up a new email or a new phone number in place of the one you lost.

The other ways to prove it is you

Depending on what is set up on your account, you can use one of these methods:

• <strong>Approval from another device already signed in.</strong> A request is sent to an eligible device; you approve it on that device, which signs a proof with its secure key (Secure Enclave). A device that is lost, revoked, or whose key has been removed cannot approve.
• <strong>Your passkey.</strong> This is a strong method: it authenticates you directly and lets you replace the lost factor.
• <strong>Face ID on a device already linked to your account.</strong> There, Face ID unlocks that device's key (the Noryo Code, specific to the app, acts as the fallback to biometrics). Face ID is never proof on its own: it is a layer of presence added to owning the device, and on an unknown device it grants no recovery rights.
• <strong>The password</strong>, only if your account has no other strong factor.

If you truly have none of these left

Exceptional recovery is the last resort. It never grants access automatically: it opens a case. Your request is verified by your trusted contacts (a quorum of 2 people) and observes an unshortenable 72-hour safety delay. You are notified as soon as the case opens, with a "This wasn't me" link that permanently freezes the request. No one, not even support, can bypass these checks.