Locked Out of Your Account

What to do when you can't use your second factor#

Work through these in order. Each one needs the code Localport emails you at sign-in, or your Google sign-in, first.

1. Use a recovery code. You saved 10 of them when you added your first second factor.

2. Ask your team for a reset. An owner or admin of a team you belong to can send you a reset link.

3. Ask your recovery contact. A team owner can name one admin who may send them a reset link.

4. Recover the account yourself. You prove the account with a browser you used before, or with a code sent to your recovery email, then wait 72 hours. A recovery email is a second address you added in Settings.

5. Contact support. Support can stop billing and close the account. Support cannot sign you in.

The sign-in screen shows the options that apply to your account. On the One more step screen select I can't use any of these, then I don't have a recovery code. The Can't sign in? screen opens.

How do I sign in with a recovery code?#

Select I can't use any of these on the One more step screen and enter one recovery code. Each code works once.

After you sign in, open the profile menu and select Settings. The Security section shows how many codes are left. Replace the passkey or authenticator app you lost before you sign out. Localport asks you to sign in again for security changes made more than 5 minutes after sign-in.

Select Replace next to Recovery codes to get 10 new codes. The old codes stop working.

How do I get my second factor reset by my team?#

Ask someone with a higher role in one of your teams. An owner or admin can reset a developer. Only the owner can reset an admin.

They do this in the dashboard.

1. Open the team and select Members.

2. Open the menu on your row and select Reset second factor.

3. Confirm in the Reset second factor? dialog.

Localport emails you a link. The link works once and expires in 1 hour. Nothing changes until you open it and confirm.

Confirming removes every passkey, authenticator app and recovery code on your account. It also signs you out on every device. Sign in with your email code, then add a second factor again in Settings.

If you own or administer another team, the reset turns your old second factors off and keeps them for 72 hours. Any one of them undoes the reset during that time.

What if I own the team?#

Nobody in your team can reset an owner. A team reset comes from a higher role, and a team has no role above owner. An owner has two other ways back in.

Your recovery contact. A recovery contact is one admin of a team you own, chosen by you in Settings. Ask them to select Reset second factor on your row in Members. Localport emails the link to your sign-in address, and it expires in 1 hour.

A recovery contact's reset turns your old second factors off and keeps them for 72 hours. Any one of them undoes the reset during that time.

Recovering the account yourself. This needs no other person and takes 72 hours.

An owner who belongs to another team as an admin or developer can also ask that team for a reset. The reset applies to the whole account.

How do I recover my account without help?#

Start a recovery from the sign-in screen, wait 72 hours, then complete it from the same screen. Nothing on the account changes during the wait.

1. Sign in with your email code or Google.

2. On the One more step screen select I can't use any of these, then I don't have a recovery code.

3. Under Recover the account yourself select Start a recovery.

4. Prove the account is yours with one of the two proofs.

5. Select Start the 72-hour recovery.

Localport accepts two proofs.

• A browser you used before. The browser signed in to this account with a passkey or an authenticator app at least 7 days ago. Start the recovery in that same browser.
• A code sent to your recovery email. The recovery email has been on the account for at least 7 days. Type the address, select Send the code, and enter the 12-digit code. The code expires in 10 minutes.

Localport emails your sign-in address and your recovery email three times. The first email arrives when the recovery starts. The second arrives 24 hours before it is ready, and the third when it is ready. Admins of the teams you own are emailed at the same times.

After 72 hours, sign in with your email code and open the Can't sign in? screen again. Select Complete the recovery. Use the same browser, or a new code from your recovery email. A recovery that is ready stays ready for 7 days.

Completing turns off every passkey, authenticator app and recovery code on the account. It signs you out on every device and opens Settings, where you add a new second factor. For 72 hours your old factors are kept, and any one of them undoes the recovery.

Who can recover an account without help?#

You can when all of these are true.

• You own every team you belong to, or you own a team with an active plan.
• The account has a passkey or an authenticator app.
• Every team you belong to allows it. An owner or admin sets Self-service account recovery in the team's Settings, under Security.
• The account is not scheduled for deletion.

You can start one recovery in 24 hours and three in 30 days.

How do I cancel a recovery I didn't start?#

Sign in with your second factor. A successful sign-in with a passkey, an authenticator app or a recovery code cancels a pending recovery.

Two more ways work without a second factor.

• Select This wasn't me in any recovery email from Localport. A page opens. Select This wasn't me. Cancel it.
• In a browser where you are still signed in, the dashboard shows a banner about the pending recovery. Select Cancel it.

A cancelled recovery changes nothing on the account. All three ways also sign out the browser that started the recovery, and that browser stops counting as a proof. After you cancel with the email link, no recovery can start on the account for 7 days.

If none of these work, email support@localport.io from the address you sign in with. Support can block the account, which stops the recovery.

Whoever started the recovery got past your email code or your Google sign-in. Secure that mailbox or Google account first.

How do I undo a reset or a recovery?#

Use one of your old second factors within 72 hours. Localport keeps them for that long after a recovery contact's reset or a recovery you completed yourself.

1. Sign in with your email code or Google.

2. On the One more step screen select I can't use any of these.

3. Select Undo a recovery.

4. Use an old passkey, your old authenticator app or an old recovery code.

Undoing restores your old second factors and removes every second factor added since the reset. It signs out every session. When you are signed in, Undo a recovery is also in Settings, in the Security section.

Some actions are unavailable during the 72 hours. You cannot transfer or delete a team, delete the account, reset a member's second factor, or change certificate authorities, your recovery contact or your recovery email.

After an undo, the account cannot be recovered without help for 30 days.

What can Localport support do?#

Support can stop billing and close your account. Support can also block an account to stop a recovery its owner did not start. Support cannot remove a second factor, sign you in or change your email address. No proof of identity changes this.

Email support@localport.io from the address you sign in with. The closure works like this.

1. Support sends a confirmation link to your sign-in address. The link works once and expires in 24 hours.

2. You open the link and confirm. Nothing happens before you confirm.

3. Your account is deleted 14 days later. Teams only you own are deleted with it.

4. Localport takes no further payment for those teams after you confirm. This includes a payment that is overdue. Deleting does not refund time left on a plan. Refund requests follow the Refund Policy.

5. Every other member of those teams gets an email with the date.

You can cancel during the 14 days. Use the link in the email Localport sends after you confirm, or sign in to the account. Cancelling does not charge you.

A team plan can be paused or ended while the closure is pending. The cancellation email names each team that needs a step. For a paused plan, select Resume plan on the team's billing page. Resuming starts a new billing period. For an ended plan, choose a plan on the same page.

How do I avoid being locked out again?#

Add a second way in before you need it. All of these are in Settings, in the Security section.

• Add a passkey on a second device, or select Add an authenticator app.
• Keep your recovery codes somewhere other than the device you sign in with.
• Select Add next to Recovery email. Localport sends security alerts to that address too. After 7 days a code sent to it can start an account recovery. A recovery email cannot be used to sign in.
• If you own a team, select Choose next to Recovery contact and pick an admin you trust.
• Check Known browsers. It lists the browsers that can prove the account is yours in a recovery. Remove any you no longer use.

Frequently asked questions#

What to read next#

• What is Localport?
• Quickstart
• Remote Access
• Member Access