Skip to content
shadcn.io

shadcn.io is not affiliated with official shadcn/ui

Two-Factor Recovery Codes Success Block for React

A two-step sign-in confirmation page: what was turned on, eight single-use recovery codes in a framed sheet with copy and download, and a Finish setup button that stays dimmed until you tick that you saved them.

Framework
UI library

Preview

Preview width

Installation

Part of Pro
Pro unlocks the code and one-line install of every Pro button and text effect, plus the MCP for your AI editor.
Have Pro already? Sign in to open it.Opens here as soon as you're Pro.

Overview

Make sure people save their way back in with this two-factor confirmation page for React with Base UI. It's the page Hatchkey, a password manager, shows after two-step sign-in is turned on: the page's side rails and one band split in two. The first half has a check in a tile, the heading, a short list of what happened (the account, the method, the paired phone, the time), a Checkbox in a Field that says "I've saved these codes", and the one Shine Button, Finish setup, which stays dimmed until the box is ticked. The second half is a framed sheet of eight single-use recovery codes in monospace on shared hairlines, with a Copy Button that copies them all and a Download Trigger that saves them as a text file. The frame's lines are drawn by Guides, with a CSS entrance only. For two-factor setup, recovery codes and any security step where a secret is shown once.

FAQ

What stays in the page, and how do I wire it for real?

Nothing was turned on: the page describes a setup that already happened. The eight codes are made-up samples in CODES that open nothing, the account, method, phone and time are typed in ON and the facts, and Finish setup only changes this page (its label becomes Setup finished and the status line says so). To wire it, generate the codes on your server when two-step sign-in is switched on, store only their hashes, return the plain codes once and build CODES from that response, then point Finish setup at your security settings.

Why is Finish setup dimmed, and what happens if I press it?

It is dimmed, not disabled, so keyboard and screen reader users can still reach it. Pressed before the box is ticked it says why in the status line ("Tick the box above first: codes are shown once.") and moves focus to the checkbox. Once the box is ticked the line reads "Ready. Finish when you like." and the button finishes. Unticking the box puts the gate back.

Do Copy all and Download really work?

Yes, they use what the browser offers. Copy all writes the eight codes to the clipboard, one per line, and a screen reader hears "All eight sample codes copied" (or that the clipboard refused, which happens on a page not served over HTTPS). Download saves a text file built from the same list, named as a sample, through the Download Trigger. Neither sends anything anywhere.

How should real recovery codes behave?

Each works once, they are shown once, and generating new ones invalidates the old set. Make them from a secure random source, store only a hash of each, and show them on this page and nowhere else. The sheet marks each code as monospace text with a left-to-right direction, so the digits and dashes read the same in a right-to-left language, and the list is named "Recovery codes" for assistive technology.

How does it look on a phone?

The message comes first, then the sheet of codes in two columns, then the checkbox. The primary is pinned to the bottom of the screen with its status line under it, so it stays in reach while the page scrolls; from the small breakpoint up it sits in the flow after the checkbox. From the large breakpoint up the two halves sit side by side with a divider between them.

  • Pro

    Backup Codes Account

    Sign-in methods

    An account's backup codes: ten one-time codes in a hairline grid with the spent ones struck through, a meter of how many are left, a real text file to download and copy, and a new set behind a password.

  • Pro

    Two-Step Setup Dialog

    Account and security

    A cloud editor's security page with a three-step dialog shown open: a QR code and its key, eight backup codes to copy or download, and a six-digit check, ending in a note that two-step sign-in is on.

  • Pro

    A split sign-in step for an investing app: a six-digit code field beside a demo authenticator whose code and draining ring change every 30 seconds, where the current code and the one before it both sign in.

  • Pro

    An account's two-factor methods as rows with their role, history and a Test that opens a code field in place, Make primary, a guarded Remove, and a Set up that opens a QR code, a key name or a number.

  • Pro

    A confirmation page for a password reset: the account, the time and the used reset link, three follow-up switches (two-step sign-in, sign out other devices, email about new sign-ins) and one sentence that says what each choice would do after sign-in.

  • Pro

    API Key Show Once Success

    Security and access

    A key confirmation inside an app panel: the secret masked with an eye toggle and a real copy button, a checkbox that turns it into its stored form, the key's scopes and dates, a request that uses it, and a Done button that waits for the box.