Recovery key: what to do if you forget your master password
With zero-knowledge encryption, nobody but you has the key to your vault - not even us. That's why you get a recovery key when you sign up. Here's how it works and where to keep it.
Blog · Security
2FA codes: why they matter and how to store them
Two-step verification stops most account takeovers. Here's how it works, which method to choose, and how to avoid getting locked out if you lose your phone.
Contents
A password isn’t enough
A password can leak from someone else’s database, get phished on a fake site, or be guessed. Two-step verification (2FA) adds a second factor - something you have (a phone, a hardware key), not just something you know. Even if someone learns your password, they can’t sign in without the second factor.
Which methods are best
- SMS - better than nothing, but your number can be hijacked (SIM swapping).
- Email code - convenient, but only as secure as your inbox.
- Authenticator app (TOTP) - the code changes every 30 seconds and is generated on your device, offline. A solid standard for most accounts.
- Hardware key (such as a YubiKey) - a physical device that’s highly resistant to phishing.
Start with the accounts that unlock other accounts: your email, banking, Google, Apple, and Microsoft accounts, and your password manager.
The problem: one person’s phone
TOTP codes usually live in a single app on a single phone. You know what happens next:
- your phone breaks or gets lost - and suddenly you can’t sign in anywhere,
- a company account with 2FA is tied to the phone of an employee who just left,
- every time you sign in, you hunt for your phone and retype six digits.
2FA codes in your password manager
Inlockly (from the Personal plan) stores the 2FA key with your login and generates the code itself:
- the code fills in after your password - in the extension, on your phone, and in apps,
- the code is encrypted like a password and calculated on your device,
- a shared company account with 2FA lives in the company folder - with the same permissions as the password,
- you can move codes over from Google Authenticator, Aegis, 2FAS, or Ente Auth.
The extension also recognizes a 2FA setup on a page and offers to save the key, and a directory of over 1,600 services tells you where else it’s worth turning on 2FA.
The exception: your Inlockly account. The second factor for your vault has to live outside the vault - that's why the app won't accept the 2FA key for your own Inlockly account.
Don’t lose access
- Save the backup codes for every important service somewhere safe.
- Inlockly gives you 10 backup codes for your own account and warns you when only three are left.
- Keep your Inlockly recovery key outside the vault - more on that in Recovery key: what to do if you forget your master password.
2FA codes without reaching for your phone. See how they work in Inlockly.
The Inlockly team
We write about password and data security the same way we build our app: practical, no scare tactics, no jargon.