Two Different Systems, Two Different Failure Modes
"Steam Guard code not arriving" actually describes two unrelated problems, and mixing them up wastes the most time. Steam runs two separate protections under one name:
- Email-based Steam Guard, the default for accounts without the mobile app: Steam emails a five character code on any new device login.
- The mobile Steam Guard Authenticator app: nothing is sent anywhere at all. The app computes a code locally on a 30 second timer, the same way any TOTP authenticator does, just with Steam's own custom alphabet. Background on how this differs from standard authenticator apps is in our Steam Guard guide.
Figure out which one you are actually waiting on before troubleshooting anything, because the fixes do not overlap at all.
When Email Codes Are the Problem
Email delivery failure has a short, predictable list of causes, in the order worth checking them.
Start with spam and junk folders. Steam's mail comes from noreply@steampowered.com, and it lands in spam constantly on Outlook and Hotmail addresses in particular, along with anything routed through corporate mail filtering. Search your entire inbox for "Steam" rather than only scanning the primary tab, since a code from an earlier attempt an hour ago can get buried by threading.
Resist hammering the resend button. Email delivery lags noticeably under load, and every new resend invalidates the code before it, so requesting three times in ninety seconds guarantees confusion when the second-to-last email finally lands and its code no longer works. Request once, then actually wait the full five minutes before trying again.
Consider whether Steam even has a working address for you. On an old account, the registered email may be one you abandoned years ago. If that mailbox still technically exists, log into it directly; recovering an old provider account is frequently the real task hiding behind "Steam won't send me a code," and our recovery guide covers the common providers' recovery paths.
Some mail providers silently drop automated bulk mail without ever routing it to spam, which looks identical to Steam simply not sending anything. Adding steampowered.com to your contacts or safe senders list helps future delivery, though it will not retroactively recover an already-dropped message.
If none of that works, go to help.steampowered.com, choose "Help, I can't sign in," and follow the path for an inaccessible email. Steam support can change the registered email after verifying ownership, and purchase history plus your original payment method are the strongest evidence you can bring to that process.
When the Mobile Authenticator Is the Problem
Since mobile codes generate entirely on-device, "not arriving" here really means the app or the phone has a specific problem, not that Steam failed to deliver anything.
First, confirm you are actually looking in the right place: Steam app, then the menu, then Steam Guard. The code sits at the top with its own countdown ring and regenerates every 30 seconds whether the app is open or not. A code that looks stale or frozen usually means the app needs to be reopened, not that anything is broken.
If codes appear but get rejected rather than being missing, that is a device clock problem, not a missing code at all. Steam's codes are time based exactly like every other TOTP implementation, and clock drift breaks them identically: turn on automatic date and time in your phone's settings, generate a fresh code, and try again. The mechanics are the same ones covered in our general time sync guide.
A worse trap is being logged out of the Steam app itself, which can demand a code you have no way to generate since you cannot get back into the app that would show it. This is genuinely circular. The way out is your recovery code, the R#### string Steam gave you during initial setup, entered through the login screen's Help path, or the SMS fallback sent to your registered phone number.
Moving to a new phone without deregistering the old one first is probably the single most common mobile authenticator failure. The authenticator is bound to one device, so codes generated on a phone you no longer have are useless, and there is no cloud sync to fall back on the way there is with some other apps. If you still have the old phone, transfer the authenticator to the new one from inside the app before wiping the old device. If you do not have the old phone anymore, remove the authenticator via SMS to your registered number, or via your recovery code, then add it fresh on the new phone.
The Cooldown Nobody Warns You About
This is the part that genuinely catches traders and market users off guard: removing or changing your Steam Guard mobile authenticator triggers a mandatory trade and market hold, typically 15 days, sometimes longer depending on account history and how the change was made. This is not a bug or an overcautious support agent; it is a deliberate anti-theft delay built into Steam's account security model, specifically because a stolen authenticator combined with an instant trade window is exactly how account theft used to drain inventories before this cooldown existed. If you are mid-trade, listing items on the market, or relying on quick inventory turnover, plan authenticator changes well in advance of anything time-sensitive, because there is no support ticket, payment, or verification level that shortens this window. The only real defense is never needing to remove the authenticator in the first place: deregister cleanly from the old phone before switching, rather than losing access and forcing an emergency removal later.
Preventing the Next Lockout
- Keep your registered phone number current: it is the SMS escape hatch for authenticator moves and emergency removals alike.
- Keep your registered email alive and secured with its own 2FA, since it is the account's ultimate root; our Gmail 2FA guide covers the setup.
- Write your recovery code down on paper the day you set up the mobile authenticator, stored with your other backup codes using the system in our backup codes guide.
- Deregister the authenticator from the old device before switching phones, every single time, even when it feels like an unnecessary extra step.
Every hard case in this article becomes soft the moment your recovery code exists somewhere other than your memory. It is the one piece of paper that turns every scenario above into a five minute fix instead of a support ticket.
Frequently Asked Questions
Why does Steam use five character codes instead of standard six digits?
Steam runs a custom TOTP variant using a 26 letter alphabet across five characters, roughly comparable entropy to six digits, but deliberately incompatible with standard authenticator apps by design. That is exactly why Steam Guard lives inside the Steam app rather than Google Authenticator or Authy; the full explanation is in our Steam Guard explainer.
Can I move Steam Guard codes into a normal authenticator app?
Not through any official path. Third party tools exist that extract Steam's underlying secret, but they carry real account safety risk and violate Steam's terms of service, and the payoff is small given how well the official app already works. The supported path is the official app plus a saved recovery code.
I received the email code but Steam still says it is wrong. Why?
Multiple resends are almost always the cause: each new email invalidates the ones before it, and inbox delivery order can arrive scrambled relative to which one is actually current. Delete all the pending codes, request exactly one fresh one, and use it immediately within its validity window.
Does removing the authenticator delete my games or inventory?
No. Your library and inventory are completely untouched by the process. You will face the trade and market hold described above, typically around 15 days, as anti-theft protection, which is inconvenient but temporary and far better than the theft scenario it is designed to prevent.
Someone else still has my authenticator on their phone, an ex-roommate or an old shared device. Is this urgent?
Yes, urgently. Whoever holds the working authenticator can approve trades on your account right now. Remove it immediately using SMS or your recovery code from Steam's account settings, change your account password, and check for any API keys you did not create yourself; the full checklist is in our Steam Guard guide.
