public cyber tool / public / browser-side

2FA Recovery Checklist

Prepare recovery before the emergency. The checklist stays in your browser and helps prevent account lockout when you change phone or device.

checklist --mfa-recovery local analysis / no remote fetch

checklist --mfa-recovery

I stored backup codes in a password manager or encrypted vault. I verified recovery email and phone from the official website. I added at least one second MFA method for critical accounts. I considered passkeys or hardware security keys for email, banking and password manager. I removed trusted devices I no longer use. I documented a recovery procedure for phone change or loss. I protected SIM and phone number with PIN or port-out controls where available. I tested at least one non-destructive recovery path without disabling MFA.

Before the emergency

Store backup codes in a protected place, separate from the phone you use to sign in.

Verify recovery email and phone only through official sessions, never through links received in messages.

For critical accounts, consider passkeys or physical security keys as phishing-resistant second factors.

references

CISA MFA guidance