After enabling 2FA on Codeberg, users are redirected to the Account Security page. At the top, there’s a green banner displaying the recovery code with a note saying it should be saved.
There are a couple of problems with this:
-
It's easy to overlook. Most platforms include an explicit confirmation step here — like requiring the user to check a box confirming they’ve saved the recovery code, or offering a download link (PDF or TXT). These extra steps help ensure the code actually gets saved, which is kind of the whole point.
-
The green banner feels misleading. Green usually signals success or completion, so many users will assume this is just a confirmation that 2FA was set up properly and may not realize there's still something important they need to do.
Suggestions:
- Add a confirmation step in the 2FA setup process that makes the user acknowledge they've saved the recovery code.
- Include a download option for the code (PDF or TXT).
- (Not needed if adding the recovery code as an additional confirmation step) Consider changing the visual style of the banner — something more neutral or attention-grabbing would make the message stand out better and clarify that there’s still an action required.
### Comment
After enabling 2FA on Codeberg, users are redirected to the Account Security page. At the top, there’s a green banner displaying the recovery code with a note saying it should be saved.
There are a couple of problems with this:
1. It's easy to overlook. Most platforms include an explicit confirmation step here — like requiring the user to check a box confirming they’ve saved the recovery code, or offering a download link (PDF or TXT). These extra steps help ensure the code actually gets saved, which is kind of the whole point.
2. The green banner feels misleading. Green usually signals success or completion, so many users will assume this is just a confirmation that 2FA was set up properly and may not realize there's still something important they need to do.
### Suggestions:
- Add a confirmation step in the 2FA setup process that makes the user acknowledge they've saved the recovery code.
- Include a download option for the code (PDF or TXT).
- (Not needed if adding the recovery code as an additional confirmation step) Consider changing the visual style of the banner — something more neutral or attention-grabbing would make the message stand out better and clarify that there’s still an action required.