Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Plan MFA recovery before you lose a phone, security key, or authenticator account. Enroll a second, independent authenticator; keep recovery codes offline and separate from the device they recover; test the recovery path; and monitor recovery notifications. For organizations, maintain tightly controlled break-glass access for genuine emergencies, with approval, logging, and a password change after every use.
Authentication and recovery are different security events
Routine authentication proves that you still control an enrolled authenticator. You sign in with a security key, approve an app prompt, enter a one-time code, or use another method the service accepts.
Account recovery starts when you no longer control the authenticator required for that routine sign-in. NIST SP 800-63B-4 (July 2025) defines recovery as regaining control after losing the authenticators needed at the desired assurance level. A provider may accept a saved recovery code, issue a new recovery code, use a recovery contact, or repeat identity proofing. It may also impose a waiting period. The exact choices, number of codes, and replacement process are service-specific.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not treat a recovery channel as a second password. It is an alternate route into the account and must be protected as carefully as the primary MFA method. A recovery event should be considered a security event: NIST says it causes one or more notifications to the subscriber or designee so fraudulent recovery can be detected.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Build a personal recovery plan before a device is lost
1. List accounts that would be difficult to replace
Start with email, password-manager, financial, cloud-storage, work, government, domain, developer, and communications accounts. Losing access to an email or password manager can block recovery of many other services, so give those accounts priority. Record the provider’s current recovery options and the date you last tested them. Do not store the list with the only copy of your recovery codes.
2. Enroll an independent second authenticator
NIST encourages subscribers to maintain at least two separate means of authentication. “Separate” matters: two authenticator apps on the same lost phone do not provide real independence. Better combinations include a primary phone app plus a spare hardware key, or a primary key plus a second key stored elsewhere. If the service supports another enrolled app or device, add it while the primary method still works.
Sign in to the account’s security settings, choose the option to add an authenticator, complete the provider’s verification step, and give the new method a recognizable name such as “spare key.” Save the confirmation and test a sign-in using the new method in a private browser window. Some services require the existing MFA method or a fresh password before allowing enrollment.
Recommended Free Tools
3. Generate and store recovery codes
When a service offers saved recovery codes, generate them during enrollment or from its security page. NIST SP 800-63B-4 says they are intended to be maintained offline and stored securely, such as on paper or another offline medium. Keep the copy separate from the phone, laptop, password manager session, or account that the codes recover. A fire-resistant document container or other controlled physical location can be used, but NIST does not require a particular product.
Do not photograph codes, put them in an unencrypted notes app, email them to yourself, or leave them in a shared chat. If you use an encrypted password manager for an additional copy, it must not be the only copy: a locked account or lost device could make that copy unavailable at the same time as the account.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Test the complete path
Testing should demonstrate more than successful enrollment. Sign out of a spare browser or test device, use the alternate authenticator, and confirm that the provider records it as an enrolled method. Verify that you can locate the paper or offline code without opening the account you are trying to recover. Check that notifications reach an address or device you still control. Avoid consuming a one-time code during a casual test unless you are prepared to replace it.
5. Record changes and remove dead methods
When you replace a phone, retire a key, change a phone number, or change an email address, update the account’s security settings and your offline inventory. Revoke authenticators you no longer possess. A spare method that is still enrolled but sitting in someone else’s hands is not a recovery control; it is an unmonitored sign-in credential.
Recovery codes: what they do and how to protect them
They are one-time credentials
A saved recovery code is normally consumed when it is used. NIST says the used code is invalidated and a replacement is issued. After using one, sign in, generate a fresh set if the provider requires it, and destroy or mark the old paper copy. Do not assume that unused codes remain valid after changing MFA settings; check the provider’s instructions.
There is no universal format
Providers decide how many codes to issue, how they are displayed, and whether a code is replaced individually or by regenerating the entire set. NIST SP 800-63B-4 specifies that a saved recovery code should contain at least 64 bits from an approved random bit generator. That is a security requirement for covered implementations, not a promise that every service will show a particular number of digits or characters.
Use an offline storage design
- Keep the primary copy on paper or another offline medium in a controlled location.
- Store it separately from the device and account it recovers.
- Limit who can physically access it; do not leave it in an unlocked desk or shared drawer.
- Make the writing legible and include the account name, generation date, and a note that each code is single-use.
- Maintain a second physical copy only when your threat model and storage controls justify it; two uncontrolled copies increase exposure.
- Replace the set after a code is used, suspected to be copied, or exposed.
Respond to recovery notifications
NIST states that an account recovery event always causes one or more notifications to the subscriber or designee. Read those messages promptly. An unexpected notice may indicate that someone used a code, a recovery contact, or an identity-proofing route. Use a known-good device to change the password, revoke unfamiliar sessions and authenticators, regenerate recovery codes, and contact the provider through its official support path. Do not approve a new MFA enrollment merely because an unexpected notification appears.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Hardware security keys and other MFA methods
CISA’s guidance says that not all MFA methods offer the same level of protection. Its listed order runs from stronger to weaker as follows:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Method | Phishing resistance | Dependence on the lost device | Practical recovery considerations |
|---|---|---|---|
| Security key | Strongest option listed by CISA when the account supports it | Independent if a spare key is stored separately | Must be compatible with the service, account, connector, and device; enroll and test a spare before it is needed |
| Number-matching app prompt | Stronger than a simple approval prompt, but still dependent on the enrolled device | High if the phone is lost | Keep another enrolled method or recovery code offline |
| App-generated one-time code | More exposed to phishing than a security key | Usually tied to the phone or authenticator backup | Export or transfer capability varies; verify it before replacing a phone |
| Biometrics | Usually device-specific and best paired with another method | Can disappear with the device or platform profile | Do not rely on it as the sole recovery route |
| Text or email code | Weakest option listed by CISA | Depends on continued control of the number or mailbox | Use only when stronger choices are unavailable, and protect the underlying phone number or email account |
The hierarchy is CISA guidance, not a guarantee that every service offers every option or implements it identically. A key is not automatically usable everywhere: check the account’s supported standards, the device’s connector or wireless capability, and whether the service permits two keys. Enroll the spare while the primary method is available, then perform a real sign-in test.
How to enroll and test a spare hardware key
- Check compatibility. In the account’s security or MFA settings, confirm that hardware security keys are supported and note the required connector or wireless mode. Check the computers and phones from which you expect to sign in.
- Prepare two keys. Keep the primary key with you and designate the second as the spare. Do not store both in the same bag or desk.
- Add the spare. Choose “add security key” or the provider’s equivalent, authenticate with the existing method, insert or pair the spare, and touch or otherwise activate it when prompted. Set a key PIN if the service requires one.
- Label the enrollment. Give each key a clear name and record which physical key it identifies. Never write a password or recovery code on the key’s label.
- Test without the primary. Sign out in a private window, select the security-key option, and authenticate with the spare. Confirm that the account logs the event under the expected key name.
- Store and review. Put the spare in a controlled, separate location. Re-test after major account, browser, operating-system, or device changes.
If a key fails, first verify that the account supports its protocol and that the connector, browser, and device are compatible. Try the other enrolled key before deleting anything. Removing the only working method can force a slower recovery process.
What to do after losing a phone or authenticator
When another authenticator still works
- Use the spare key or alternate enrolled method to sign in from a trusted device.
- Open the security settings and revoke the lost phone, old app enrollment, and sessions you do not recognize.
- Change the account password if the lost device could have exposed it or if the device was unlocked.
- Enroll the replacement phone or authenticator and test it.
- Regenerate recovery codes if they were stored on the lost device or may have been copied.
- Review recovery and sign-in notifications for activity you did not initiate.
When no alternate method works
Use a saved recovery code only through the provider’s normal sign-in or recovery screen. Avoid links in unsolicited messages. Follow the service’s identity-proofing or recovery-contact process exactly; a waiting period may be intentional. During that period, secure the email account and phone number associated with the service, because an attacker who controls either may be able to intercept recovery messages.
After access is restored, replace consumed codes, revoke the lost authenticator, enroll at least one independent method, and document what failed. If the provider denies recovery, use its official support process rather than repeatedly guessing codes, which can trigger lockouts.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Break-glass access is an organizational control
A break-glass account is an emergency path for administrators when normal identity services or MFA dependencies are unavailable. It is not a convenient shared administrator login and is not a substitute for routine MFA. Consumer accounts generally should use the provider’s alternate authenticator and recovery process; organizations must additionally control authorization, custody, monitoring, and post-incident review.
Define when it may be used
Write specific triggering conditions, such as an identity-provider outage, loss of all normal administrators, or an incident that blocks the ordinary MFA path. Name who can declare an emergency, who may approve use, and who must be notified. Keep eligibility narrow and review it when staff or responsibilities change.
Protect the credential and its custody
Use a dedicated emergency account rather than an everyday administrator identity. Restrict its permissions to what an emergency requires, and keep the credential under controlled custody. Document the account owner, authorized users, approval route, storage location, and notification list. These are operational design choices; CISA’s infrastructure guidance does not prescribe one universal custody model.
Follow CISA’s core safeguards
In its Enhanced Visibility and Hardening Guidance for Communications Infrastructure, CISA recommends retaining local accounts for emergencies, changing their passwords after each use, and checking that every use was authorized and expected. Apply those controls together: a password change without a log review leaves uncertainty about who used the account, while a log review without rotation leaves the same credential exposed.
Log, alert, and review every activation
- Record the incident, approver, operator, start and end times, systems accessed, and actions taken.
- Alert security personnel when the account is used, not only after the incident.
- Compare the activation with the declared emergency and authentication or network logs.
- Change the password immediately after use and verify that old sessions and tokens are invalidated where the platform supports it.
- Conduct a post-use review and update the normal access path so the emergency account does not become routine.
Separate emergency infrastructure access from the primary identity store
For everyday network-infrastructure administration, CISA recommends a centralized AAA server that supports MFA and is not linked to the primary corporate identity store. This is context-specific communications-infrastructure guidance, not a universal requirement for every organization. The principle is to avoid making the same identity dependency both the normal control plane and the only way to recover it.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Choose recovery methods by risk, not convenience alone
| Decision question | What to evaluate |
|---|---|
| Is it resistant to phishing? | Prefer a security key when the account supports it; treat text and email codes as fallback options. |
| Does it depend on the lost device? | Favor a separately stored key or offline code over a second app on the same phone. |
| Can it work offline? | Printed or written codes can, while app prompts, SMS, and email generally require a functioning device or network. |
| How long can recovery take? | Check for provider-imposed waiting periods and plan an alternate route for time-critical accounts. |
| How is it revoked or replaced? | Know how to remove a lost key, invalidate codes, replace a phone, and terminate old sessions. |
| Does it cover every critical account? | Map the methods to your email, password manager, work systems, finance, cloud, and administrative services; support differs by provider. |
No single method is best for every account. NIST’s recovery and assurance requirements apply to covered services, while CISA’s hierarchy expresses relative protection among the methods it lists. Your final plan should account for the service’s actual capabilities and the consequences of losing access.
Common failure modes and fixes
- Both authenticators are on one phone: enroll a separately stored key or another device before the phone is lost.
- Codes are stored in the account they recover: print or write an offline copy and keep it in a separate controlled location.
- A recovery code was reused: assume it is invalid; generate a replacement set after the first use.
- The spare key was never tested: perform a sign-in test while the primary method still works.
- An old phone or key remains enrolled: revoke it during every device replacement.
- An unexpected recovery notification is ignored: treat it as a possible compromise, secure the account, and review logs and sessions.
- The break-glass account is used for convenience: restrict its eligibility, alert on every use, and investigate any activation that is not tied to an approved emergency.
- A key does not work on a new device: check protocol, connector, browser, operating-system support, and account policy before removing the working method.
Maintenance schedule
At enrollment
Record the provider, enrolled methods, recovery-code generation date, notification destinations, and the location of the offline copy. Test the alternate method.
After every recovery or device change
Revoke lost authenticators, replace used or exposed codes, enroll the replacement method, review notifications, and confirm that old sessions are closed.
On a regular review cycle
Check that spare keys still work, paper copies are legible and accessible to authorized people, emergency-account owners and approvers are current, and break-glass logs have been reviewed. Revisit the plan after organizational changes, provider MFA changes, or a security incident.
Bottom line
Resilient MFA is designed, not improvised after a phone disappears. Keep two independent authentication paths, store recovery codes offline and separately, replace every consumed code, prefer phishing-resistant keys where supported, and respond to recovery notifications. Organizations should add a narrowly scoped break-glass account with controlled custody, authorization checks, immediate password rotation, and a documented review of every use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
