Lost Access to 2FA

If you can't use your passkey or your authenticator app, there are three ways back in, in this order: another method you already have, a recovery code, and, if neither works, our support team.

First: Try Another Method You Have

On the Finish signing in screen, click Use another method. It lists every method on your account.

• A passkey saved in a password manager (iCloud Keychain, Google Password Manager, 1Password) is usually on your other devices too. Try your phone, tablet or another computer.
• A passkey on your phone works with any computer: in the browser's passkey window choose Use a phone or tablet and scan the QR code. See Passkeys.
• An authenticator app on a new phone may already have your codes if the app backs them up or syncs them, as Google Authenticator, Microsoft Authenticator and 1Password can.
• A trusted browser you ticked Don't ask for a second step on this browser for 30 days on will sign you in without the second step, if it was within the last 30 days.

Sign In With a Recovery Code

You have 5 minutes after a recovery-code sign-in to add a new method without needing anything else. After that, adding one asks you to confirm with a passkey or authenticator app, which you may not have, so don't click Later unless you have another way in. If the 5 minutes pass, sign out and sign in again with another recovery code.

Then:

• If your authenticator app was on a lost phone, set it up on the new phone with Change app in Settings → Security. A recovery code is accepted to confirm, and codes from the old phone stop working once the new one is verified.
• Generate new recovery codes if you are running low.
• Remove any passkey that was on a lost device, from Settings → Security → Passkeys.

Signing in with a recovery code also forgets every trusted browser, and we email you that a recovery code was used. The second step does not offer to trust the browser when you use a recovery code.

Already Signed In Somewhere?

If you're still signed in on another browser, you can fix things from there. Two actions in Settings → Security accept a recovery code when the Hub asks you to confirm it's you:

• Change app, to move your authenticator app to a new phone
• Turn off 2FA

When Nothing Works: Ask Support

If you can't use your passkey, your authenticator app or a recovery code, click Can't use any of these? on the second step. Our support team can turn off 2FA after checking it's you.

During those 3 days, the second step at sign-in and Settings → Security both show 2FA reset requested, with the date and a Cancel the reset button.

When the 3 days are up:

• your passkeys, authenticator app and recovery codes are removed
• every browser is signed out and every trusted browser forgotten
• we email you that two-factor authentication is off, turned off by Two Minute Reports support at your request

You can then sign in with your password, Google, Microsoft or an email code, and set up 2FA again.

Why the Wait

Email is the weakest part of most accounts. If someone got into your inbox, they could ask us to turn off your 2FA. The 3 days give the real owner time to notice the email and stop it.

If a Team Requires 2FA

If you belong to a team that requires two-factor authentication, the next time you open that team the Hub asks you to set 2FA up again before showing it. Your other teams work as normal.

Avoid Getting Here Again

• Save your recovery codes somewhere other than your phone, such as a password manager or a printed copy.
• Have two methods. A passkey and an authenticator app, or passkeys on two devices.
• Use a password manager that syncs passkeys, so a lost phone doesn't take your only passkey with it.