On waking my computer from sleep today, 2025-05-05, I was presented with a pCloud login dialogue box.
I entered my username and password and the 2FA security code prompt presented.
When I opened Google Authenticator on my phone, however, there were no pCloud credentials therein.
pCloud is the only 2FA service I authenticate using Google Authenticator. So, on the unlikely chance I’d somehow managed to set a different authenticator app as the 2FA client, I checked through all my other Authenticator apps (I have eight of them installed: it’s enough of an administrative pain to make 2FA feel like more hassle than it is worth).
My memory was not lying to me. I didn’t have pCloud credentials in any of them either.
I was able to workaround the problem using one of of my ten onetime recovery codes.
I used that to login to my pCloud account in my browser.
And, once in, I turned 2FA off and then turned it on again.
Which produced a new QR code.
Which I scanned in Google Authenticator.
And, voila, a pCloud account in the app and a six figure, time-limited code to enter at the security code prompt on my desktop.
I duly entered said code and was logged-in to my pCloud account.
Also, turning 2FA off and then on again generated ten further onetime recovery codes. That is, I was presented with ten onetime recovery code strings that are in addition to the ten onetime recovery code strings I was provided when I first turned 2FA on back on 2024-12-01.
I’ve added these further strings to my local password database, appropriately labelled so as to distinquish them from the initial ten.
All of which leaves me with two questions.
How the hell did this happen in the first place?
My memory is no more perfect than any other person’s, but I am confident I used the Google Authenticator app as a 2FA client at least once since I set up 2FA for pCloud back on 2024-12-01.
So, how did my credentials get entirely wiped from the Google Authenticator app without so much as a by your leave?
NB: I am using the same phone today as I was using when I first setup 2FA for pCloud.
Do any of the onetime recovery codes provided consequent to enabling 2FA on 2024-12-01 still work or were they made obsolete by my turning 2FA off and then on again today, 2025-05-05?
The [How can I set up Two-factor authentication?](https://www.pcloud.com/help/general-help-center/ how-can-i-set-up-two-factor-authentication) documentation does not make it clear if turning 2FA off and then on again makes your extant onetime recovery codes obsolete.
The current text is as follows:
> When setting Two-factor authentication, you will also receive 10 > one-time recovery codes. It is very important that you store these > codes in a secure place. If you ever lose your phone, or can't > receive a security code, you will need a recovery code for > emergency access to your pCloud account. You can use a recovery > code only once. If you have used all your recovery codes or you > suspect that they have been compromised, you can reset them at any > time from the Two-factor authentication settings.
The word, reset, is a overloaded load-bearing word here. It is reasonable to infer it means your old codes won’t work after you’ve turned 2FA off and then back on again.
But I shouldn’t have to infer from documentation. Docs should be entirely explicit: if [this state or action] then [this consequence or change].