Quick answer
If it's your password, use "Forgot your password?" to reset it. If it's the second step (the 6-digit code), enter a saved backup code or pick another method on the login screen, then re-set up two-step authentication on your new device. No backup codes and no access to your old phone? You'll need Xero to reset it after verifying your identity.
WHY IT HAPPENS
Two locks, two different keys.
Xero protects your accounts with two things: your password, and a second step (multi-factor or two-step authentication) — normally a 6-digit code from an authenticator app that changes every 30 seconds. Most lockouts are one or the other. Passwords get forgotten after a reset. The second step breaks when you switch or wipe a phone, because those codes are tied to the specific device and don't move across on their own. Work out which lock is the problem, then fix that one.
1. If it's your password
THE FIX
Reset it, then check your login basics.
- Use "Forgot your password?"On the Xero login page, click the reset link, enter the email address your Xero account uses, and follow the email that arrives. Set a strong, unique password you don't use anywhere else.
- Check the reset email hasn't been filteredIf nothing lands in a couple of minutes, look in Junk or Spam and search your inbox for "Xero". Confirm you used the correct email address — many people have more than one.
- Rule out the browserClear your browser cache and cookies, or try a private/incognito window or a different browser. A stale saved page or old cookie is a common cause of a login that "won't take" a correct password.
2. If it's the second step (2FA)
THE FIX
Recover the code, or re-set it up.
- New phone? Use a backup code firstWhen you first set up two-step authentication, Xero gives you a list of one-time backup codes to save. On the "enter your code" screen, choose the option to use another method or a backup code, and type one in. Each code works once.
- No code arriving?If you use an authenticator app, codes are generated on the device itself and don't rely on mobile signal — so check the app is open and the time on your phone is set to automatic (a wrong clock makes codes invalid). If you use SMS or email codes, confirm the number/address on file is still yours and check your junk folder.
- Re-register on your new deviceOnce you're in, open your profile, go to Account → security settings, turn off two-step authentication, then switch it back on and scan the new QR code with the authenticator app on your current phone. Save the fresh backup codes somewhere safe.
- Account locked after several tries?Repeated wrong attempts temporarily lock the account for a short cool-down (around 15 minutes). Stop guessing, wait it out, then try once with details you're confident about rather than triggering another lockout.
- Still shut out — ask Xero to reset itIf you can pass the password but not the second step, and you have no backup codes and no access to the old device, use Xero's login/account support form to request a reset. Xero verifies your identity before removing two-step authentication, so it isn't instant — but it's the safe route back in.
Never turn security off to make life easier. Xero holds your bank feeds, payroll and financial data — it's a prime target. Two-step authentication is what stops a leaked password becoming a break-in. The right fix is to recover access, not to disable protection. If a "Xero support" email or call asks you to hand over a code or reset MFA on the spot, treat it as a scam and stop.
