Password · guide

How to reset Gmail password when recovery keeps refusing

By Alberto Gulotta · Updated 9 September 2026 · 18 min read

How to reset Gmail password: if you can still sign in, open your Google Account, Security and sign-in, Password. If you cannot, it is account recovery, which has no limit on attempts and one rule that stops it dead — recovery details changed recently may take seven days to count.

1. Work out which of the two you are doing. If you can still open the mailbox, this is a change and it takes a minute. If you cannot sign in at all, it is account recovery, and recovery has conditions that a change does not.
2. Signed in: open your Google Account, then Security & sign-in. Google’s wording for the next step is “In the section ‘How you sign in to Google,’ click Password”, and it warns that “you might need to sign in again” on the way.
3. Enter the new password and select Change Password. Google adds one rule about the choice: pick “a password that you haven’t already used with this account”.
4. Locked out: start the recovery flow and answer as best you can. Google’s own instruction invites imprecision: “You’ll be asked some questions to confirm it’s your account. Answer the questions as best as you can.”
5. Keep going after a wrong answer. The one fact that changes how this feels: “Wrong guesses won’t kick you out of the account recovery process. There’s no limit to the number of times you can attempt to recover your account.”
6. If no email arrives, work through Google’s four checks. In its order: look in “junk, spam, or bulk folders”; add noreply@google.com to your address book; request another email; and “check all email addresses you might’ve used to sign up or sign in to your account”.
7. If you have just added a recovery phone or address, stop and wait. Google: “If you change your account recovery info, it may take up to 7 days for those changes to take effect. Try to recover your account again in a few days.” Attempting daily does not shorten it.
8. Afterwards, expect to sign in again nearly everywhere. The exceptions are narrow, and two of them are worth checking on purpose: third-party apps you have authorised, and home devices you have given account access, can keep working with the old grant.

The seven days are the part worth planning around. Google’s sentence is short and the consequence is not: “If you change your account recovery info, it may take up to 7 days for those changes to take effect.” Somebody locked out of an account will reasonably try to add a phone number they can reach, and that addition is exactly the one the flow will not accept yet. The move that works is the opposite one: use the details that were already on the account a week ago, even if they are inconvenient, and treat the new ones as next week’s option.

Recovery is a set of questions, not a form with a right answer. Google’s own instruction — “answer the questions as best as you can” — describes a weighted judgement rather than a test that is passed or failed on any single line. Combined with the absence of an attempt limit, that makes an approximate answer worth giving: the month you created the account, an old password you half remember, a device you usually sign in from. Abandoning the attempt is the only move that certainly does not work.

What signing out everywhere actually leaves behind. The list of exceptions is short and two of the three are grants rather than sessions: “some devices with third-party apps that you’ve given account access”, and “helpful home devices that you’ve given account access”. A new password does not withdraw a permission that was granted to an application, so if the reason for the reset was that somebody else had reached the account, the list of authorised apps is the second thing to read and the first thing to prune.

The reach of one password. A Gmail password is a Google Account password, so it stands in front of Drive, Photos, Play, YouTube and anything signed in with Google elsewhere. That makes it a poor candidate for reuse and a good candidate for the second factor: the account is the key to a great many other doors, and a second factor is the difference between a leaked password being a nuisance and being an emergency. What the two names for it actually mean is on two-factor and two-step.

The click paths, the attempt rule, the seven-day delay, the four checks for a missing email, the three exceptions to signing out, the Google Fi warning and the position on telephone support are quoted from two Google Account Help pages, read on 7 September 2026. The storage requirement and the rules for choosing the replacement are quoted from NIST Special Publication 800-63B, read the same day. That Google documents no way to view an existing password is a statement about those pages, not a claim about how the system is built.

Not covered here. It does not cover an account you use through work or school. Google says so first: “if you use an account through your work, school, or other group, these steps might not work”, and the administrator holds the reset.

It does not cover recovering a Google Account that was deleted, or one belonging to a child, both of which Google routes to separate flows.

And it does not rank password managers. That question has its own way in, the guides on passwords and the ways in. What holds instead is simple: every rule, delay and exception on this page is quoted from Google’s own account help with the date it was read, and the requirement that explains why no password can be shown back to you is quoted from the United States federal guidance rather than asserted.