Use one of the recovery codes you saved when you turned on two-factor authentication. Enter it wherever you'd normally enter the six-digit code. In the Classic web client, that means after your password and a /. Each recovery code works once.

Once you're in, go to Preferences → Two-Factor (or the Security tab in Classic):

• to keep using two-factor authentication on a new phone, enter a recovery code, click Turn off, then set it up again on the new phone. The old phone's codes stop working.
• if you're running low, enter a code and click New recovery codes. Your old recovery codes stop working.

No recovery codes left? Contact support. Once we've confirmed who you are, we can switch two-factor authentication off for your mailbox so you can sign in with your password and set it up again.

Looking for the 16-character backup code for the billing and support area? That's a separate setting. See I don't have my Two-Factor Authentication device with me.