Manage 2FA, passkeys, and recovery codes

Regenerate recovery codes

1. Open the person-icon Account menu at the top right, choose Account Settings, then Security in the sidebar, or open Account Security.
2. Choose Regenerate recovery codes.
3. In Confirm it’s you, enter your current password and a current six-digit code from your authenticator app, then choose Continue. A recovery code cannot authorize regeneration. Add your first password if prompted before changing security settings.
4. Save the 10 new one-time recovery codes in a secure place separate from your device using Download .txt or Copy all.
5. Check I've saved these recovery codes somewhere safe., then choose Done.

Regeneration replaces the full set. Every old recovery code becomes invalid immediately, and the new codes are shown only once.

Disable two-factor authentication

Disabling two-factor authentication requires your current password plus either a current authenticator code or one unused recovery code.

1. Open Account menu → Account Settings → Security and choose Disable 2FA.
2. In Confirm it’s you, enter your current password plus your current authenticator code or an unused recovery code. Add your first password if prompted before changing security settings.
3. Choose Continue and wait for confirmation.

Disabling it removes the authenticator setup and every recovery code. It does not end existing signed-in sessions.

EZFormz allows you to disable two-factor authentication even when the account has no passkey. Your account keeps password sign-in; disabling 2FA does not remove or reset your password.

Rename or remove a passkey

Open Account menu → Account Settings → Security and find the Passkeys list. Choose Rename beside a passkey, enter its new name in the browser prompt, and confirm. To remove a passkey you no longer control, choose Remove beside it and confirm the browser's removal prompt. Check the updated list after either change.

You can remove the last passkey only while two-factor authentication remains enabled. If two-factor authentication is off, keep at least one passkey or add another before removing the old one.

Protect an active account

Renaming or removing passkeys, regenerating recovery codes, and disabling two-factor authentication do not invalidate existing sessions. Signing out ends only the current session; the account page does not provide a remote Sign out everywhere action. Adding a first password, changing a password or using password recovery signs out every browser session.

EZFormz sends security notices when two-factor authentication is enabled or disabled and when passkeys are added or removed. If a notice is unexpected, secure your email account, retain control of any factor that still works, and contact support.

Those notices identify the event and include request context such as time and IP address. They are warnings, not remote-revocation controls. Removing a suspicious passkey prevents future sign-in with that passkey but does not end a session that was already created.

Never share authenticator codes, recovery codes, QR codes, manual setup secrets, or passkey approval prompts. For initial setup and recovery guidance, see Secure your account access.