Verification methods
What passwords, passkeys, authenticators, recovery codes and email each do, why keeping two methods matters, and how recovery codes are consumed.
Which methods exist
| Method | Purpose | Notes |
|---|---|---|
| Password | The most basic credential | Vulnerable to credential stuffing; do not make it the only method |
| Passkey | Sign in with device biometrics or a security key; phishing-resistant | Bound to a device; re-register on a new device |
| Authenticator (TOTP) | Six-digit codes as a second step | Depends on accurate phone time |
| Recovery codes | Fallback when everything else fails | Single-use; each code is spent once |
| Email verification | Proves address ownership and enables password recovery | Not a sign-in credential, but it decides whether the account is recoverable |
Why keep at least two
Losing a single method means losing the account: lose the phone and the authenticator is gone; switch platforms and the passkey is gone. With two or more, any one failing still leaves a way back.
Recommended pairs: passkey + recovery codes (passkey daily, codes stored offline), or password + authenticator.
How recovery codes work
- Each code works once; used codes are spent and never "come back";
- Store them offline (printed, or in a password manager) — not on the same phone, or you lose both together;
- Generate a new batch before the last one is used, not after.
Adding and removing
Add and remove them one by one under verification methods in account settings. Removing the last remaining method is usually refused: that would make the account unusable.
My authenticator stopped working after a new phone
Sign in with a recovery code, then immediately re-register the authenticator and generate new recovery codes. Without a recovery code, only the account recovery flow remains.
Related
- Password questions: Password and recovery
- Why you are asked to verify again: Sign-in and verification
Password and recovery
Forgot your password, the reset email never arrived, still cannot sign in after resetting, and password policy questions.
Sessions and devices
Where to see signed-in devices, how to revoke one session or all others, whether signing out affects other devices, and why sessions expire.