Managing your 2FA Recovery Codes

As a backup method to your Two-Factor Authentication (2FA) app, Tidepool gives you the option to save recovery codes. These are important to save somewhere safe and private, because when used with your email address and password, someone could gain access to your Tidepool account.

Think of a recovery code as a stand-in for your 2FA app. If someone has your password and a recovery code, it's the same as if they had your password and your unlocked phone — they can get in. Store your codes with that in mind.

If you use a shared or clinic computer

Many clinicians access Tidepool from a workstation used by other staff. If that's you, keep these guidelines in mind:

Do:

• Save your codes in a password manager tied to your own individual login (not a shared clinic account others can open)
• If you use cloud storage like OneDrive or Google Drive, make sure it's your personal, individually authenticated account — and save the codes as a password-protected file, not a plain text file
• Print your codes and store the printout somewhere only you can access, like a locked drawer or your own badge-access folder

Don't:

• Save the codes as a plain file on the shared computer's desktop or downloads folder
• Leave a printed copy near a shared printer, on a monitor, or anywhere a coworker could pick it up
• Store codes on an unencrypted USB drive
• Let your browser save your recovery codes as autofill text on a shared computer

Each recovery code works only once. If you use one, Tidepool will let you know how many you have left and offer to let you generate a new set. Regenerating your codes invalidates all previous ones.

Checking how many codes you have left

1. Go to your account security settings.
2. Under Recovery Codes, you'll see how many of your 12 codes have been used, for example 3/12 used.

Regenerating your recovery codes

If you're running low on codes, think a code may have been seen by someone else, or are switching devices, you can generate a brand new set at any time.

1. From Account Settings in the Two-Factor Authentication section under Recovery Codes, click Regenerate Codes.
   
2. Confirm the replacement. A window will appear warning that this will permanently replace your existing codes, and any unused codes you have left will stop working. Click Yes, generate new codes to continue.
   
3. Re-authenticate. For security, you'll be asked to log in again. Enter your password and click Next.
   
   Complete logging in, which may include entering a 2FA code from your authenticator app.
4. Save your new codes. Your new set of 12 recovery codes will appear. Save them somewhere safe right away — see the guidance above if you're on a shared or clinic computer. Check I have saved these codes someplace safe, then click Finish.
   

Important: Once you generate new codes, your old codes stop working immediately, even if you hadn't used all of them. Make sure you've saved the new set before you leave the page — you won't be able to view them again afterward.

Have questions? Ask your local IT team for guidance. They may have a preference on how you manage recovery codes for apps you use like the Tidepool Data Platform.

SUP-238