What you'll do
Add 2FA or a passkey from Account Security, save a recovery method, and understand the manual recovery path.
Add your first password
Your existing email address is your username. New accounts verify it and choose a password during signup. Existing accounts must add a first password by November 9, 2026 at 8:00 AM Eastern Standard Time, even if they use a passkey. Choose Add password now after sign-in, Account Settings → Security → Add password, or Haven’t added a password yet? on Log In. Follow the fresh email-code or existing-passkey verification and any enabled-factor prompt. If your email is unverified, complete its verification when asked.
Save work in other tabs before setup. Adding a password signs out all browser sessions while keeping the same account, forms, orders, authenticator, passkeys and unused recovery codes. Sign in again afterward. For the grace period and full steps, see Sign in and add your password.
Change or recover your password
While signed in, choose Account Settings → Security → Change password. Enter your current password, new password and confirmation. If 2FA is enabled, enter the current authenticator code too. This routine change sends no email and signs out all browser sessions.
If you forgot your current password, choose Forgot password on Log In instead. Verify the code emailed to your account, then choose a replacement password for the verified email shown. Recovery also signs out every browser session and preserves 2FA, passkeys and unused recovery codes; it cannot reset a lost authenticator. If another tab changes the signup or recovery account, restart the affected flow and verify the intended email again. Logging out clears unfinished signup or recovery setup.
Set up 2FA
- While signed in, open the person-icon Account menu at the top right, choose Account Settings, then choose Security in the sidebar. Choose Enable two-factor authentication, then confirm your current password. Add a password first if the account is still transitioning.
- Scan the QR code with a TOTP authenticator such as Google Authenticator, Authy, 1Password, or Bitwarden.
- Enter the current six-digit authenticator code and choose Verify & show codes.
- Save the 10 one-time recovery codes somewhere separate from your phone. Use Download .txt or Copy all to keep a secure copy.
- Check I've saved these recovery codes somewhere safe., then choose Enable 2FA. Setup is not complete until this final step succeeds.
Password accounts sign in with email address → password → authenticator code when 2FA is enabled. Legacy accounts use their email code until password setup. A passkey can sign in directly when its PIN/biometric verification succeeds. Touch-only hardware keys use password login or the legacy-code/setup path.
Enter login and authenticator codes only on ezformz.net. EZFormz staff will never ask for a login code, authenticator code, recovery code, QR setup secret, or manual TOTP secret. Store recovery codes securely and separate from the enrolled device.
Add a passkey
- Open Account menu → Account Settings → Security. Under Passkeys, choose + Add a passkey and confirm your current password plus enabled authenticator or recovery code.
- Approve the browser prompt using a device, password manager or hardware key that verifies your PIN or biometrics.
- Give the passkey a recognizable name in the naming prompt and confirm it. Check that the new passkey appears in the list.
A passkey stored in a syncing password manager can work across the devices connected to that manager. A second passkey or 2FA plus recovery codes provides a backup.
Passkeys may also be device-bound. A hardware key, a passkey stored in another password manager, or 2FA plus saved recovery codes avoids depending on one device or one sync account. The login page lets the browser offer any passkey registered for EZFormz.
Passkeys are phishing-resistant because the browser checks the relying-party domain before creating a valid signature. That does not make every approval prompt safe: begin from ezformz.net, confirm that you intended the sign-in, and do not approve an unexpected prompt.
Use more than one recovery path
A practical setup is one passkey in a trusted syncing password manager, 2FA in an authenticator app, and recovery codes stored separately. Another hardware or device-bound passkey can be a useful backup but is not required.
EZFormz sends security notices when 2FA is enabled or disabled and when a passkey is added or removed. The notices include event context such as the time and request IP. Treat an unexpected notice as an account-security incident; securing only EZFormz is not enough if the account email or password manager is also compromised.
Recover access
Try another registered passkey first. At the 2FA prompt, you can instead use one unused recovery code.
If every passkey, authenticator, and recovery code is unavailable, submit a support ticket with the subject 2FA Account Recovery. EZFormz does not offer email-only 2FA reset. An admin must verify at least two ownership signals before an approved reset.
Do not send the answers or supporting account details until support asks for the specific evidence through the ticket. Never send a live login code, authenticator code, recovery code, QR setup secret, or passkey prompt as evidence.