Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePlan MFA recovery before a phone, authenticator, or security key disappears. Enroll a second authentication method, keep recovery codes offline and separate from the device they protect, test the spare method, and document the account provider’s recovery process. For organizations, keep emergency break-glass accounts separate from ordinary user recovery and monitor every activation.
Routine authentication proves that you are an enrolled user. Recovery starts when you have lost control of the authenticator needed for that proof. It may require a recovery code, another enrolled method, a recovery contact, identity proofing, or a waiting period, and it should be treated as a security event.
As an Amazon Associate I earn from qualifying purchases.
Authentication and recovery are different security paths
During routine sign-in, a service checks the factors already attached to your account: for example, a password plus an authenticator-app code or a hardware key. Recovery exists for the exception in which those factors are unavailable or no longer under your control.
NIST Special Publication 800-63B-4, the July 2025 edition that supersedes the 2020 publication, defines account recovery as regaining control after losing the authenticators needed at the required assurance level. A service may support saved recovery codes, issued recovery codes, recovery contacts, repeated identity proofing, or other methods based on its risk analysis. There is no universal recovery screen or code format.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Recovery is inherently less convenient than normal sign-in. A provider can impose additional checks or a delay to reduce the chance that an attacker who has stolen one factor can immediately replace all of your factors.
Why recovery activity needs attention
NIST states that an account-recovery event causes one or more notifications to be sent to the subscriber or an assigned designee so fraudulent recovery can be detected. Read those alerts. An unexpected recovery email, text, or security-center event is evidence that someone may be trying to take over the account, even if the attempt failed.
Build a personal recovery plan before you lose a device
1. List the accounts that would be difficult to replace
Start with email, password managers, identity providers, financial services, cloud storage, work systems, domain and hosting accounts, and any service that can reset other passwords. Record which MFA methods each account supports and whether the provider offers recovery codes, a second key, a recovery contact, or identity verification.
Keep the inventory outside the phone that holds your primary authenticator. A printed checklist or a separately protected digital record can identify the provider’s current recovery instructions without becoming another single point of failure.
2. Enroll an alternate authenticator while the primary still works
NIST says subscribers should be encouraged to maintain at least two separate means of authentication. The alternate method should not depend on the same lost device, battery, account, or physical location as the primary method.
- Enroll a spare security key and store it separately from the key you carry.
- Where the service allows it, enroll an authenticator app on a second device that you control.
- Save the provider’s recovery codes during enrollment.
- Confirm that the alternate method actually completes a sign-in before you rely on it.
Adding a method is not the same as testing it. Sign out, use the spare method, and verify that you can reach the account without silently falling back to the lost device.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Store recovery codes offline
Recovery codes are credentials, not reminders. NIST SP 800-63B-4 says saved codes are intended to be maintained offline and stored securely. Print or write them down, then keep them in a protected place that is separate from the phone, laptop, password manager session, or account they recover.
Do not photograph codes, paste them into an ordinary notes app, email them to yourself, or leave a copy in the same bag as your phone. An optional physical container can protect paper from casual access, but NIST does not require a particular lockbox or product. The essential properties are offline storage, controlled access, and independence from the device being recovered.
4. Record the replacement procedure
For each important account, note where to find the security settings, how to add or remove an authenticator, how to report a lost device, and which recovery channel is monitored. Provider wording, the number of codes, replacement rules, and waiting periods vary, so use the account provider’s current instructions rather than copying a generic sequence.
Recovery codes: how to use and maintain them
What a saved code does
A saved recovery code is a one-time credential intended for the situation in which your normal authenticator is unavailable. NIST says a code should be issued at enrollment when the service supports this option. The same publication specifies at least 64 bits of security from an approved random bit generator for saved recovery codes; that is a requirement on the generated secret, not a universal number of visible characters in every service’s printed list.
Use one code, then replace it
NIST says a saved code is invalidated after use and a new code is issued. After signing in with a code, open the account’s security settings and generate or download a fresh set. Marking a code as used on paper is not enough if the provider has already invalidated it, and retaining an old list can create confusion during the next emergency.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Respond to recovery notifications
Check the time, device, location, and action described in every recovery notification. If you did not initiate it, use a trusted session or the provider’s incident process to change the password, revoke sessions and authenticators you do not recognize, and report the attempted recovery. Do not follow links in a suspicious message; open the provider through a known bookmark or manually entered address.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Keep the code set synchronized
- Destroy or clearly mark superseded printed lists after generating a replacement.
- Update the protected copy if the provider regenerates all codes rather than one code.
- Tell the authorized backup person when custody changes, without sending the codes through ordinary email or chat.
- Revisit the storage location when you move, change jobs, or change who is responsible for the account.
Hardware security keys and other MFA choices
CISA describes security keys as the strongest option in its listed MFA hierarchy and says a physical key provides the best protection against phishing. Its ordering is guidance, not a guarantee that every account supports every option. A key must be compatible with the account, browser, operating system, connector, and enrollment protocol.
| Method | Phishing resistance | Works without the lost phone? | Recovery and availability considerations |
|---|---|---|---|
| Security key | Strongest of the listed CISA options | Yes, if an enrolled key is available | Requires account and device compatibility; enroll and test a spare before the primary is lost |
| Number-matching app prompt | Stronger than a simple code, but still dependent on the app and its approval flow | Only if another enrolled device receives the prompt | Protect the alternate device and verify that the service supports multiple enrolled devices |
| Authenticator-app one-time code | Below a security key in CISA’s hierarchy | Yes, if a second device or a saved recovery code is available | Device migration and backup behavior are service-specific; test the second enrollment |
| Biometric unlock | Usually device-specific and best combined with another method | Usually not if the enrolled device is gone | A biometric normally unlocks an authenticator or device; it is not automatically a portable recovery factor |
| Text or email code | Weakest of the listed CISA options | Only if the phone number or mailbox remains available | Use only when stronger choices are unavailable; control the recovery phone and email separately |
CISA summarizes the design principle as: “Not all MFA methods offer the same level of protection.” Choose the strongest method that the service supports, then keep an independent fallback rather than assuming a weaker channel will always be available.
Enroll and test a spare security key
- Sign in through the account’s normal security or MFA settings while your current method still works.
- Choose the option to add a security key or passkey, following the provider’s exact label.
- Insert or connect the spare key, complete its touch or local verification step, and give it a recognizable name.
- Sign out in a separate browser window and authenticate with the spare key.
- Store the spare away from the primary key and record its location without publishing that location in an account note.
- Repeat the compatibility check after major browser, operating-system, or account-policy changes.
Do not buy a key on the assumption that one model works everywhere. Check the service’s supported standards and the ports or wireless interfaces on the devices you will use. A key that is compatible with one account may not be accepted by another.
Free tools Windows power users keep installed
One-click scans. No signup required.
Using an alternate authenticator app
An authenticator app on a second device can be practical when the service supports multiple enrollments or a controlled migration. Enroll it before an emergency and test a real sign-in. Some providers show a QR code only once, some invalidate the old enrollment when a new one is created, and some require administrator approval; follow that provider’s instructions rather than assuming that an app backup will restore every account.
What to do immediately after losing a phone or key
- Use the independent method first. Try the enrolled spare key, second authenticator, or a saved recovery code from your protected offline copy.
- Secure the lost device and sessions. Use the device-management or account-security tools available from a trusted session to lock, erase, sign out, or revoke the lost device. The exact controls depend on the service and device platform.
- Remove the missing authenticator. Once you have a verified sign-in, delete the lost phone or key from the account’s enrolled methods and add the replacement.
- Regenerate consumed codes. If a recovery code was used, obtain a new set and retire the old list.
- Watch for recovery alerts. Treat an unfamiliar notification as a possible compromise and use the provider’s official incident route.
- Use the provider’s recovery flow if no factor remains. Expect identity questions, a recovery contact, administrator intervention, or a waiting period. Avoid services or people offering to bypass those controls.
If the lost phone held your email account or password manager, recover those accounts first. They may control password resets for many other services. Prioritize the account that can reset the greatest number of downstream accounts, then work through the rest of the inventory.
Break-glass access is an organizational emergency control
A personal recovery code helps one user regain an account. A break-glass account is an organizational mechanism for restoring administrative access when the normal identity or MFA path is unavailable. It should be rare, tightly controlled, and monitored, not a convenient way around MFA.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Controls identified by CISA
In guidance for communications infrastructure, CISA recommends keeping local accounts for emergencies, changing their passwords after each use, and verifying that every use was authorized and expected. For everyday network-infrastructure administration, the same guidance recommends a centralized AAA server that supports MFA and is not linked to the primary corporate identity store. That recommendation is specific to the infrastructure context; it is not a universal consumer-account recipe.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDefine the break-glass operating procedure
- Ownership: Name the team responsible for the account and a backup owner.
- Eligibility: Define which incident conditions justify activation and who may request it.
- Approval: Require an approval path appropriate to the severity of the outage, with an emergency exception documented in advance.
- Credential custody: Store the password and any physical factor in separate, access-controlled locations. Limit who can retrieve them.
- Notification: Alert the security or incident-response team at activation, not days later.
- Monitoring: Send login, privilege, and configuration events to logs that remain available even if the primary identity system is down.
- Post-use review: Change the password after every use, confirm the use was authorized and expected, inspect the actions taken, and restore the account to its sealed state.
Document the account’s exact permissions and test the procedure under controlled conditions. A break-glass account that has never been used or whose password has expired may fail during the incident it was created to solve; a permanently active account with broad privileges creates a standing target.
Separate normal administration from emergency administration
Routine administrators should use the organization’s centralized identity and MFA controls. The emergency account should not become the default when a normal login is inconvenient. Keep its credentials, logging path, and approval evidence independent enough to function during an outage, while still applying least privilege and time-limited access wherever the platform permits it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compare recovery methods against the risks that matter
| Question | Saved recovery code | Spare security key | Second authenticator device | Break-glass account |
|---|---|---|---|---|
| Independent of a lost phone? | Yes, if stored separately | Yes, if stored separately | Yes, if the second device is independent | Designed for an organizational identity-system outage |
| Phishing resistance | One-time secret can be phished if entered on a fake site | Strongest listed by CISA | Depends on prompt or code design | Depends on the account’s controls; it is not inherently phishing-resistant |
| Offline availability | Yes when printed or written and securely stored | Yes, subject to device compatibility | Usually requires the enrolled device | Depends on custody, local access, and surviving infrastructure |
| Replacement after use or loss | Used code is invalidated; obtain a new set | Revoke the missing key and enroll a replacement | Remove the lost device and enroll another | Change the password after every use and review the event |
| Typical delay | Often immediate, but provider-specific | Often immediate when compatible | Usually immediate when the second device is available | May include incident approval and operational checks |
| Best fit | Personal and small-team account recovery | High-value accounts that support keys | Services that support multiple app enrollments | Emergency administration of organizational infrastructure |
Test the plan and maintain it over time
Recovery plans decay when accounts, devices, staff, and policies change. Test each critical account after enrollment and whenever you replace a phone, rotate an administrator, change a connector, or alter the identity provider.
- Verify that the spare key or second device still signs in.
- Confirm that printed codes are legible, current, and stored where the authorized person can reach them.
- Check that notifications arrive at an address or device that is monitored independently of the lost factor.
- Review the list of enrolled authenticators and remove devices or keys that no longer exist.
- For organizations, inspect break-glass logs and confirm that password rotation and post-use review are documented.
Run a controlled exercise rather than waiting for a real loss. The exercise should prove that an authorized person can recover access without disabling MFA globally, and that the security team can distinguish an expected recovery from an attacker’s attempt.
Common failure modes and fixes
All factors are on one phone
Symptom: The phone, authenticator app, recovery email, and password manager disappear together. Fix: Move at least one factor and the recovery-code copy to an independent device or physical location, and enroll the alternate method before the next loss.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
The only recovery-code copy is in the locked account
Symptom: Codes were saved in cloud storage that requires the same MFA account. Fix: Keep a secure offline copy and verify that it can be reached without the account it protects.
A recovery code was reused
Symptom: A previously printed list fails after one code was used. Fix: Treat the list as spent, generate a replacement set, and destroy or clearly mark the old list.
The spare key was never enrolled
Symptom: A new key is available but the account does not recognize it. Fix: Add and test it while the primary method works; possession alone does not grant access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
SMS or email is treated as the preferred fallback
Symptom: The recovery plan relies on a text message or an inbox that may also be compromised. Fix: Prefer a security key, number-matching prompt, or authenticator code when supported, and use text or email only when stronger choices are unavailable.
The break-glass account becomes routine
Symptom: Administrators use the emergency account for convenience and no one reviews its activity. Fix: Enforce eligibility and approval rules, alert on every use, rotate the password after each activation, and investigate whether normal access needs repair.
A practical recovery policy
A concise policy can require every critical account to have two independent authentication means, offline recovery codes where offered, a tested spare key or alternate device when supported, and documented provider-specific recovery instructions. It can also require notification review after recovery and define who owns each organizational break-glass credential.
The strongest plan is not the one with the most factors; it is the one that remains usable when the primary device is gone without creating an unmonitored bypass. Separate the credentials physically or logically, test them before an emergency, and make every recovery or break-glass activation visible to the people responsible for security.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
