Skip to Help content

Manage security factors

Manage 2FA, passkeys, and recovery codes

Outcome: Regenerate, disable, rename, or remove factors without assuming sessions are revoked.

Regenerate recovery codes

  1. Open Account Security.
  2. Choose the option to regenerate recovery codes.
  3. Enter a current six-digit code from your authenticator app. A recovery code cannot authorize regeneration.
  4. Save the 10 new one-time recovery codes in a secure place separate from your device.

Regeneration replaces the full set. Every old recovery code becomes invalid immediately, and the new codes are shown only once.

Disable two-factor authentication

You can disable two-factor authentication with either a current authenticator code or one unused recovery code.

Disabling it removes the authenticator setup and every recovery code. It does not end existing signed-in sessions.

EZFormz allows you to disable two-factor authentication even when the account has no passkey. In that case, the account returns to email-code sign-in only.

Rename or remove a passkey

Use the passkey list in Account Security to rename a passkey so you can identify its device, or remove one you no longer control.

You can remove the last passkey only while two-factor authentication remains enabled. If two-factor authentication is off, keep at least one passkey or add another before removing the old one.

Protect an active account

Renaming or removing passkeys, regenerating recovery codes, and disabling two-factor authentication do not invalidate existing sessions. Signing out ends only the current session; the account page does not provide a remote Sign out everywhere action.

EZFormz sends security notices when two-factor authentication is enabled or disabled and when passkeys are added or removed. If a notice is unexpected, secure your email account, retain control of any factor that still works, and contact support.

Those notices identify the event and include request context such as time and IP address. They are warnings, not remote-revocation controls. Removing a suspicious passkey prevents future sign-in with that passkey but does not end a session that was already created.

Never share authenticator codes, recovery codes, QR codes, manual setup secrets, or passkey approval prompts. For initial setup and recovery guidance, see Secure your account access.