2FA Recovery Checklist

2FA recovery plan

Risk score: 84/100 (Critical)
Critical accounts: 10
Authenticator app: One device
Backup codes: Saved somewhere
Hardware keys: No keys
Phone/SMS reliance: Some accounts
Password manager status: Partial

Prioritized checklist:
1. [Do now] Rank the first 5 critical accounts - Put email and identity-provider accounts first, then financial, work, developer, social, and cloud storage accounts.
2. [Next] Add two hardware keys where supported - Enroll one daily key and one spare key for the accounts that guard everything else.
3. [Next] Verify authenticator recovery - Confirm whether your authenticator syncs, exports, or requires old-device transfer. Record the answer in your recovery notes.
4. [Next] Refresh stale backup codes - Regenerate codes for important accounts and replace old copies in your storage location.
5. [Next] Audit SMS fallback - Open security settings for critical accounts and remove text-message fallback where stronger options exist.
6. [Next] Fill password manager recovery gaps - Add recovery notes to every critical account entry without storing raw backup codes in shared or synced places you do not trust.
7. [Keep healthy] Keep one offline recovery copy - Store a printed or sealed copy of the recovery map somewhere physically separate from your main devices.
8. [Keep healthy] Run a recovery drill twice a year - Pick one account and confirm that backup codes, hardware keys, and authenticator recovery instructions still work.
9. [Keep healthy] Remove old factors and devices - After adding stronger recovery paths, remove old phones, unknown devices, and unused app passwords.

Do not store account names, passwords, backup codes, or recovery secrets in this exported plan unless you place the file in a private vault.
Generated locally by https://passlock.to/tools/two-factor-recovery-checklist