Identify the prompt
- Account password: the password you set for EZFormz, used with your existing email address as your username. It is separate from a password protecting a buyer-facing form.
- Email code: a six-digit code from
noreply@ezformz.net, used for email verification, password recovery or first-password setup for a legacy account. It expires after 15 minutes; routine password sign-in does not send one. - 2FA code: a changing six-digit code from a TOTP authenticator app. You see this after password sign-in, legacy email-code verification or a sensitive account change when 2FA is enabled.
- Recovery code: one of the one-time codes saved when 2FA was enabled. Use it instead of an authenticator code.
- Passkey: a credential approved by your device, password manager, or hardware key. It can sign you in without waiting for an email code.
New accounts verify email and choose a password. Existing accounts must add their first password by November 9, 2026 at 8:00 AM Eastern Standard Time, including accounts with a passkey. See Sign in and add your password for the transition steps.
Complete the right flow
- Enter your account email and choose Next. If a password box appears, enter your password and choose Log In. If the page says You haven’t set a password for this account yet, choose Create your password and follow verification for that same email before creating your first password.
- If a second-factor screen appears, enter the current authenticator code. Completing all six digits submits it automatically; Verify & continue also submits it. To use an unused recovery code, choose Use a recovery code instead, enter it, and choose Use recovery code.
- To use a passkey, choose Sign in with passkey and approve the browser PIN or biometric prompt. A verified passkey can sign in directly without a separate authenticator prompt; it does not remove the requirement to add a first password during the transition.
If an authenticator code fails, set the device time automatically, wait for the next code, and try again on the same screen. Request a new email code only if the sign-in expires or too many second-factor attempts were rejected.
A passkey is an alternative sign-in method, not an extra prompt after the email code. The browser binds it to the EZFormz site, which makes it resistant to a look-alike site's request. Still inspect the browser address and approve passkey prompts only when you intended to sign in to ezformz.net.
An authenticator app and its recovery codes are one factor set. A recovery code is consumed when used. A passkey may be device-bound or may sync through its password manager; EZFormz cannot restore a passkey that was removed from that device or manager.
When saving a form asks for verification
Verify your account to save confirms your account email through an email code. A passkey still works for ordinary sign-in, but it does not replace this email-verification step when the account needs one. Complete any required second factor, then return to the form and choose Save form.
If access is lost
If you forgot your password, use Forgot password and verify your account email before choosing a replacement. This keeps 2FA and passkeys enabled. Try another registered passkey if available; at an authenticator prompt you can use an unused recovery code. If neither is available, follow Set up 2FA, passkeys, and recovery. Email-only 2FA reset is intentionally unavailable.
Removing a passkey or disabling 2FA does not sign out sessions that already exist. Changing your account email revokes other sessions while keeping the session performing the change. Adding a first password, changing a password and password recovery sign out every browser session and require a fresh login; they preserve your authenticator, passkeys and unused recovery codes. Save work in other tabs first.