Both live under Contul meu (My account). Each change asks for the code from your authenticator app, so a stolen session alone cannot change them.
Contul meu › Parolă (My account › Password): Parola actuală (Current password), Parola nouă (New password) of at least 12 characters, twice, and the Cod din aplicația de autentificare (Code from the authenticator app). Then Schimbă parola (Change the password).
An account made by the superadmin starts with a one-time password and opens straight on this page until a password of its own is set.
Contul meu › Coduri de recuperare (My account › Recovery codes) shows how many unused codes you have. Enter the code from your authenticator app and press Generează coduri noi (Make new codes): ten new codes replace all the old ones. Save them before you leave the page; they are not shown again.
- You still have a recovery code: sign in with it instead of the six-digit code, then make new recovery codes.
- No phone and no recovery code: ask the superadmin. In Conturi (Accounts) it can reset your two-step verification; at the next sign-in you set up a new authenticator.