Lost your 2FA device

If you lost or reset your phone, or deleted your authenticator app, you can no longer get the code that the app.blackbox.md panel asks for at the “Two-Factor Authentication” step. This step appears when you open the panel from blackbox.md, through “Contul meu” (My account) → “Panou de administrare” (Admin panel), or when you sign in directly at app.blackbox.md/login. Below are the three ways to get back in and what to do afterward.

Available to: the blackbox.md account holder who has enabled two-factor authentication (2FA) in the panel.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Losing the device only affects signing in to the panel. Your blackbox.md account works as usual: you can make payments, view your orders and invoices, and open support tickets.

Which option to choose

Option 1: sign in with a recovery code

When you enabled 2FA (and each time you regenerated your codes), you received 8 recovery codes, 8 characters each. Each code can be used only once, in place of the code from the app.

1. Open the panel from blackbox.md: “Contul meu” (My account) → “Panou de administrare” (Admin panel), or the “Deschide panoul” (Open the panel) button on the “Profilul meu” (My profile) page. You can also sign in directly at app.blackbox.md/login.
2. At the “Two-Factor Authentication” step, click the “Use recovery code instead” link. The field changes to “Recovery Code”, with the hint “Enter one of your 8-character recovery codes.”
3. Enter one of your unused codes. Uppercase and lowercase letters don't matter.
4. If you came from blackbox.md, check “Remember this device for 30 days” so you don't use up another code the next time you sign in from the same browser.
5. Click “Verify”. The panel opens.

You must finish the code step within 5 minutes, with no more than 5 attempts. If time runs out, start signing in again from the beginning.

After you sign in with a recovery code

Important A recovery code gets you into the panel, but 2FA stays linked to the app on the lost device. While 2FA is enabled, the panel does not let you set up a new app, and it has no button to turn 2FA off. To move to a new phone, first ask support to reset 2FA (option 3).

Until the reset:

1. Open “Security” in the sidebar (or the user menu → “Security & 2FA”) and check “Recovery codes remaining”. The number is highlighted when 2 or fewer codes remain.
2. If you have only a few codes left, click “Regenerate Recovery Codes”, enter your password in the “Current password” field and click “Regenerate”. If you sign in from blackbox.md, your current password is your blackbox.md account password.
3. Save the 8 new codes (“Copy All”). The old codes stop working.

For accounts created only with Google or GitLab, regeneration does not work: such an account has no password for you to enter.

Option 2: reset 2FA by email

The “Two-Factor Authentication” step also has a “Lost 2FA device?” link, meant for resetting 2FA by email. The reset page, “Reset Two-Factor Authentication”, asks for your panel username and password, and sends a link to your account's email address. The link is valid for 15 minutes and can be used only once. Your panel username is your email address. Only the panel's 2FA is reset.

If the link takes you back to the sign-in page, the email doesn't arrive, or the link in the email has expired, use option 3. Accounts created only with Google or GitLab have no panel password, so this option does not work for them.

Option 3: ask support for help

This option is available for any account, and it is the only way to reset 2FA for accounts created only with Google or GitLab.

1. Write to support@blackbox.md from your blackbox.md account's email address. You can also open a support ticket from “Contul meu” (My account) → “Ajutor și suport” (Help and support).
2. Say that you lost the device you use for the panel's 2FA, and ask for 2FA to be removed.
3. Support verifies your identity and removes 2FA.
4. Once support confirms, open the panel from blackbox.md. You will no longer be asked for a code.

All contact channels: How to contact BLACKBOX support.

After 2FA is reset

Whether 2FA was reset by email or by support:

• 2FA is disabled: under “Security”, “Status” shows “Disabled”.
• All panel sessions end, and browsers remembered for 30 days are no longer recognized. Sign in again.
• Your old recovery codes no longer work.
• Your password, your blackbox.md sessions and your API tokens stay the same.

Turn 2FA on again on your new phone and save the 8 new codes, following the steps in Two-factor authentication (2FA) in the panel.

How to avoid getting locked out next time

Tip Keep your recovery codes somewhere other than your phone: in a password manager, or printed out and stored in a safe place.

• When you change phones, first move your authenticator app to the new phone (using the app's transfer or backup feature) and sign in to the panel once with a code from the new phone. Only then reset or hand over the old phone. In the app, the entry appears as “BlackBox”, with your email address.
• Keep an eye on “Recovery codes remaining” and regenerate your codes when only a few are left.

Frequently asked questions

Does uppercase or lowercase matter in a recovery code? No. The code has 8 characters, only digits and the letters A to F, and you can type it in uppercase or lowercase.

Can I turn off 2FA myself, so I don't have to enter the code anymore? No. The panel has no button to turn 2FA off. 2FA can be removed only through a reset (options 2 and 3).

I lost both my phone and my codes. Can I still pay my invoices? Yes. Your blackbox.md account is not affected: payments, your balance, orders and support tickets work as usual. A 2FA reset is needed only to sign in to the panel.

I created my account with Google or GitLab. What are my options? If you have your recovery codes, option 1. Otherwise, write to support (option 3): the email reset and code regeneration both require a panel password, which such an account does not have.