# Disable two factor auth with only backup codes

**URL:** https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588
**Category:** Support
**Created:** [February 7, 2019, 10:31am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588 "2019-02-07T10:31:54Z")
**Posts on this page:** 11
**Page:** 1

<div class="post-metadata">

### Author: ![tajchumber](https://avatars.discourse-cdn.com/v4/letter/t/5daacb/32.png) [@tajchumber](https://meta.discourse.org/u/tajchumber)
#### Post date: [February 7, 2019, 10:31am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/1 "2019-02-07T10:31:55Z")

</div>

Hello everyone,

I recently had to reset my phone so I lost all my Google Authenticator codes (for Two-Factor Authentcation)

I have backup codes so I can log in to my Discourse accounts but I cannot disable/update two factor auth from my account.

Is there a way to do it that I missed?

Thanks for all the help!

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 7, 2019, 10:37am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/2 "2019-02-07T10:37:45Z")

</div>

If you can log in (you kept backup codes, excellent work), you can disable two factor. Just edit it in your user preferences.

---

<div class="post-metadata">

### Author: ![tajchumber](https://avatars.discourse-cdn.com/v4/letter/t/5daacb/32.png) [@tajchumber](https://meta.discourse.org/u/tajchumber)
#### Post date: [February 7, 2019, 10:40am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/3 "2019-02-07T10:40:03Z")

</div>

I tried, it asks me an authentication code (which obviously I don’t have) and it doesn’t allow me to input one of my backup codes on the input field (It only allows 6 characters)

 ![46](https://global.discourse-cdn.com/meta/original/3X/d/0/d012da79a0d12d5e83bae5440e0d4d0eacc9d265.png)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 7, 2019, 10:44am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/4 "2019-02-07T10:44:20Z")

</div>

Our CSS there looks a little messed up cc @Johani. Worth a check.

I thought the backup codes worked the same as the app codes, is this not the case @nbianca?

---

<div class="post-metadata">

### Author: ![tajchumber](https://avatars.discourse-cdn.com/v4/letter/t/5daacb/32.png) [@tajchumber](https://meta.discourse.org/u/tajchumber)
#### Post date: [February 7, 2019, 10:46am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/5 "2019-02-07T10:46:05Z")

</div>

@codinghorror authentication codes from apps are 6 character longs while the generated backup codes are 16

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 7, 2019, 10:47am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/6 "2019-02-07T10:47:32Z")

</div>

The other option is to have a staff member disable 2FA on your account, but I agree we should fix this up since you’re currently stuck.

---

<div class="post-metadata">

### Author: ![tajchumber](https://avatars.discourse-cdn.com/v4/letter/t/5daacb/32.png) [@tajchumber](https://meta.discourse.org/u/tajchumber)
#### Post date: [February 7, 2019, 10:53am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/7 "2019-02-07T10:53:34Z")

</div>

Hope I’m not asking a lot but can we do both? I’d like to be able to access my accounts ahaha

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [February 13, 2019, 10:13pm UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/9 "2019-02-13T22:13:24Z")

</div>

Actually, @maja can you take a break from the Ember 3.7 upgrade and ensure we can disable 2FA using either authentication or backup codes?

---

<div class="post-metadata">

### Author: ![maja](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/maja/32/129533_2.png) [@maja](https://meta.discourse.org/u/maja)
#### Post date: [February 28, 2019, 10:33am UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/11 "2019-02-28T10:33:08Z")

</div>

This has been fixed per this commit:

[https://github.com/discourse/discourse/commit/6f427589b2d79f0c66b6183762a9b122ecdadc10](https://github.com/discourse/discourse/commit/6f427589b2d79f0c66b6183762a9b122ecdadc10)

Sorry for the inconvenience @tajchumber

---

<div class="post-metadata">

### Author: ![tajchumber](https://avatars.discourse-cdn.com/v4/letter/t/5daacb/32.png) [@tajchumber](https://meta.discourse.org/u/tajchumber)
#### Post date: [March 5, 2019, 12:59pm UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/12 "2019-03-05T12:59:04Z")

</div>

Now it works like a charm! thanks @maja 🙂

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [March 5, 2019, 4:37pm UTC](https://meta.discourse.org/t/disable-two-factor-auth-with-only-backup-codes/108588/13 "2019-03-05T16:37:53Z")

</div>


