Regarding the export: make sure it’s either a JSON or ZIP export (the latter is unencrypted, but also would contain attachments if you had any). And make sure, it’s not the account-restricted encrypted JSON export you chose!
Regarding your vault, and I hope I don’t forget anything, but: if you don’t have any of these, your vault is effectively lost now:
your TOTP seed code you deleted (e.g. stored somewhere else, written down on your emergency sheet etc.)?
your 2FA recovery code (stored on your emergency sheet – or somewhere in your vault ?)
did you ever set up another one of the 2FA options besides TOTP (email, “passkey”, Yubico OTP, DUO)? (–> you would see the option “Select another method” when you try to log in to any of the BW clients)
a working login-passkey (–> works without 2FA, and you could login to the web vault and change your 2FA options)
Yes, the passkey part is tricky because you must set it up explicitly; if you didn’t, it would still appear as an option that “doesn’t work.” You need to remember whether you set it up, and where you stored the passkey. As in @Nail1684’s linked pages, the setup screens would look like this:
I was showing the screens to jog your memory to see if you created a passkey in the past that would let you log in without another 2FA — it seems you didn’t.
Without another 2FA or a recovery code, your best option may be to create a new account, import the data, verify the data, then delete the old account. This time, set up multiple 2FAs and keep the recovery code safe. For 2FAs, continue using a TOTP authenticator, and if you use a Windows machine, use Windows Hello as the passkey authenticator.
For TOTP authenticators, consider using one that lets you export data periodically so you don’t repeat this problem. Ente is usually recommended as it’s cross‑platform. I personally use 2FAS (app).
Well, your problem is not only that you can’t log in to the web vault. At the moment you cannot log in to any new instance of any BW app/client. You essentially lost the ability to perform a new log in entirely, that’s why I wrote earlier that you already lost your account. (only exception: current instances where you might have checked “remember me (2FA) for 30 days” for a login)
And isn’t that exactly the kind of protection that 2FA is for? It’s exactly doing what it’s supposed to do: blocking any login attempt where the second factor can’t be provided.
And there is no magical backdoor BTW – 2FA can’t be circumvented here.
If you do decide to start over, I recommend doing so with a new (or plussed) email address, and leaving at least one device logged in on the old account until you are sure that the new account is working perfectly.
Once done, you can delete the old account and optionally rename the new one to the original name (using the web vault).
