Regenerate recovery codes
- Open the person-icon Account menu at the top right, choose Account Settings, then Security in the sidebar, or open Account Security.
- Choose Regenerate recovery codes.
- Enter a current six-digit code from your authenticator app and choose Generate new codes. A recovery code cannot authorize regeneration.
- Save the 10 new one-time recovery codes in a secure place separate from your device using Download .txt or Copy all.
- Check I've saved these recovery codes somewhere safe., then choose Done.
Regeneration replaces the full set. Every old recovery code becomes invalid immediately, and the new codes are shown only once.
Disable two-factor authentication
You can disable two-factor authentication with either a current authenticator code or one unused recovery code.
- Open Account menu → Account Settings → Security and choose Disable 2FA.
- Enter your current authenticator code or an unused recovery code in the confirmation dialog.
- Choose Disable 2FA in that dialog and wait for confirmation.
Disabling it removes the authenticator setup and every recovery code. It does not end existing signed-in sessions.
EZFormz allows you to disable two-factor authentication even when the account has no passkey. In that case, the account returns to email-code sign-in only.
Rename or remove a passkey
Open Account menu → Account Settings → Security and find the Passkeys list. Choose Rename beside a passkey, enter its new name in the browser prompt, and confirm. To remove a passkey you no longer control, choose Remove beside it and confirm the browser's removal prompt. Check the updated list after either change.
You can remove the last passkey only while two-factor authentication remains enabled. If two-factor authentication is off, keep at least one passkey or add another before removing the old one.
Protect an active account
Renaming or removing passkeys, regenerating recovery codes, and disabling two-factor authentication do not invalidate existing sessions. Signing out ends only the current session; the account page does not provide a remote Sign out everywhere action.
EZFormz sends security notices when two-factor authentication is enabled or disabled and when passkeys are added or removed. If a notice is unexpected, secure your email account, retain control of any factor that still works, and contact support.
Those notices identify the event and include request context such as time and IP address. They are warnings, not remote-revocation controls. Removing a suspicious passkey prevents future sign-in with that passkey but does not end a session that was already created.
Never share authenticator codes, recovery codes, QR codes, manual setup secrets, or passkey approval prompts. For initial setup and recovery guidance, see Secure your account access.