shadcn.io is not affiliated with official shadcn/ui
Two-Factor Recovery Codes Success Block for React
A two-step sign-in confirmation page: what was turned on, eight single-use recovery codes in a framed sheet with copy and download, and a Finish setup button that stays dimmed until you tick that you saved them.
Installation
Overview
Make sure people save their way back in with this two-factor confirmation page for React with Base UI. It's the page Hatchkey, a password manager, shows after two-step sign-in is turned on: the page's side rails and one band split in two. The first half has a check in a tile, the heading, a short list of what happened (the account, the method, the paired phone, the time), a Checkbox in a Field that says "I've saved these codes", and the one Shine Button, Finish setup, which stays dimmed until the box is ticked. The second half is a framed sheet of eight single-use recovery codes in monospace on shared hairlines, with a Copy Button that copies them all and a Download Trigger that saves them as a text file. The frame's lines are drawn by Guides, with a CSS entrance only. For two-factor setup, recovery codes and any security step where a secret is shown once.
FAQ
What stays in the page, and how do I wire it for real?
Nothing was turned on: the page describes a setup that already happened. The eight codes are made-up samples in CODES that open nothing, the account, method, phone and time are typed in ON and the facts, and Finish setup only changes this page (its label becomes Setup finished and the status line says so). To wire it, generate the codes on your server when two-step sign-in is switched on, store only their hashes, return the plain codes once and build CODES from that response, then point Finish setup at your security settings.
Why is Finish setup dimmed, and what happens if I press it?
It is dimmed, not disabled, so keyboard and screen reader users can still reach it. Pressed before the box is ticked it says why in the status line ("Tick the box above first: codes are shown once.") and moves focus to the checkbox. Once the box is ticked the line reads "Ready. Finish when you like." and the button finishes. Unticking the box puts the gate back.
Do Copy all and Download really work?
Yes, they use what the browser offers. Copy all writes the eight codes to the clipboard, one per line, and a screen reader hears "All eight sample codes copied" (or that the clipboard refused, which happens on a page not served over HTTPS). Download saves a text file built from the same list, named as a sample, through the Download Trigger. Neither sends anything anywhere.
How should real recovery codes behave?
Each works once, they are shown once, and generating new ones invalidates the old set. Make them from a secure random source, store only a hash of each, and show them on this page and nowhere else. The sheet marks each code as monospace text with a left-to-right direction, so the digits and dashes read the same in a right-to-left language, and the list is named "Recovery codes" for assistive technology.
How does it look on a phone?
The message comes first, then the sheet of codes in two columns, then the checkbox. The primary is pinned to the bottom of the screen with its status line under it, so it stays in reach while the page scrolls; from the small breakpoint up it sits in the flow after the checkbox. From the large breakpoint up the two halves sit side by side with a divider between them.
Related
- Pro
Backup Codes Account
Sign-in methodsAn account's backup codes: ten one-time codes in a hairline grid with the spent ones struck through, a meter of how many are left, a real text file to download and copy, and a new set behind a password.
- Pro
Two-Step Setup Dialog
Account and securityA cloud editor's security page with a three-step dialog shown open: a QR code and its key, eight backup codes to copy or download, and a six-digit check, ending in a note that two-step sign-in is on.
- Pro
Two-Factor Authenticator Login
Codes and approvalsA split sign-in step for an investing app: a six-digit code field beside a demo authenticator whose code and draining ring change every 30 seconds, where the current code and the one before it both sign in.
- Pro
Two-Factor Methods Account
Sign-in methodsAn account's two-factor methods as rows with their role, history and a Test that opens a code field in place, Make primary, a guarded Remove, and a Set up that opens a QR code, a key name or a number.
- Pro
Password Reset Follow-ups Success
Security and accessA confirmation page for a password reset: the account, the time and the used reset link, three follow-up switches (two-step sign-in, sign out other devices, email about new sign-ins) and one sentence that says what each choice would do after sign-in.
- Pro
API Key Show Once Success
Security and accessA key confirmation inside an app panel: the secret masked with an eye toggle and a real copy button, a checkbox that turns it into its stored form, the key's scopes and dates, a request that uses it, and a Done button that waits for the box.