diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html b/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html
index 39f41268d4..a052f370f0 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_enable.html
@@ -1,6 +1,7 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
 {% load bootstrap3 %}
+{% load icon %}
 {% block title %}{% trans "Enable two-factor authentication" %}{% endblock %}
 {% block content %}
     <h1>{% trans "Enable two-factor authentication" %}</h1>
@@ -11,8 +12,41 @@
         </p>
         <p>
             {% trans "You will no longer be able to log in to pretix without one of your configured devices." %}
-            {% trans "Please make sure to print out or copy the emergency tokens and store them in a safe place." %}
         </p>
+        {% if new_emergency_tokens %}
+            <div class="panel panel-default">
+                <div class="panel-heading">
+                    <h3 class="panel-title">{% trans "Your emergency codes" %}</h3>
+                </div>
+                <div class="panel-body">
+                    <p>
+                        {% blocktrans trimmed %}
+                            If you lose access to your devices, you can use one of your emergency tokens to log in.
+                            We recommend to store them in a safe place, e.g. printed out or in a password manager.
+                            Every token can be used at most once.
+                        {% endblocktrans %}
+                    </p>
+                    <ul>
+                        {% for code in new_emergency_tokens %}
+                        <li>{{ code }}</li>
+                        {% endfor %}
+                    </ul>
+                    <p>
+                        <label>
+                            <input type="checkbox" required>
+                            {% trans "I stored my emergency tokens in a safe place." %}
+                        </label>
+                    </p>
+                </div>
+            </div>
+        {% else %}
+            <p>
+                {% icon "info-circle" %}
+                {% blocktrans trimmed with generation_date_time=static_tokens_device.created_at %}
+                    You generated your emergency tokens on {{ generation_date_time }}.
+                {% endblocktrans %}
+            </p>
+        {% endif %}
         <div class="form-group submit-group">
             <a href="{% url "control:user.settings.2fa" %}" class="btn btn-default btn-cancel">
                 {% trans "Cancel" %}
diff --git a/src/pretix/control/templates/pretixcontrol/user/2fa_main.html b/src/pretix/control/templates/pretixcontrol/user/2fa_main.html
index 0f08998349..653b17024d 100644
--- a/src/pretix/control/templates/pretixcontrol/user/2fa_main.html
+++ b/src/pretix/control/templates/pretixcontrol/user/2fa_main.html
@@ -1,5 +1,6 @@
 {% extends "pretixcontrol/base.html" %}
 {% load i18n %}
+{% load icon %}
 {% load bootstrap3 %}
 {% block title %}{% trans "Two-factor authentication" %}{% endblock %}
 {% block content %}
@@ -152,19 +153,30 @@
             </p>
             {% if static_tokens_device %}
                 <p>
+                    {% icon "info-circle" %}
                     {% blocktrans trimmed with generation_date_time=static_tokens_device.created_at %}
                         You generated your emergency tokens on {{ generation_date_time }}.
                     {% endblocktrans %}
                 </p>
-            {% else %}
+                <a href="{% url "control:user.settings.2fa.regenemergency" %}" class="btn btn-default">
+                    <span class="fa fa-refresh"></span>
+                    {% trans "Generate new emergency tokens" %}
+                </a>
+            {% elif user.require_2fa %}
                 <p>
-                    {% trans "You don't have any emergency tokens yet." %}
+                    {% icon "warning" %}
+                    <strong>{% trans "You don't have any emergency tokens yet." %}</strong>
+                </p>
+                <a href="{% url "control:user.settings.2fa.regenemergency" %}" class="btn btn-default">
+                    <span class="fa fa-refresh"></span>
+                    {% trans "Generate emergency tokens" %}
+                </a>
+            {% else %}
+                <p class="help-block">
+                    {% icon "info-circle" %}
+                    {% trans "Emergency tokens will be generated when you enable two-factor authentication." %}
                 </p>
             {% endif %}
-            <a href="{% url "control:user.settings.2fa.regenemergency" %}" class="btn btn-default">
-                <span class="fa fa-refresh"></span>
-                {% trans "Generate new emergency tokens" %}
-            </a>
         </div>
     </div>
 {% endblock %}
diff --git a/src/pretix/control/views/user.py b/src/pretix/control/views/user.py
index 315b1ef041..412a56bc3f 100644
--- a/src/pretix/control/views/user.py
+++ b/src/pretix/control/views/user.py
@@ -584,14 +584,39 @@ class User2FAEnableView(RecentAuthenticationRequiredMixin, TemplateView):
             return redirect(reverse('control:user.settings.2fa'))
         return super().dispatch(request, *args, **kwargs)
 
+    def get(self, request, *args, **kwargs):
+        new_tokens = None
+        try:
+            static_tokens_device = StaticDevice.objects.get(user=self.request.user, name='emergency')
+        except StaticDevice.MultipleObjectsReturned:
+            static_tokens_device = StaticDevice.objects.filter(
+                user=self.request.user, name='emergency'
+            ).first()
+        except StaticDevice.DoesNotExist:
+            static_tokens_device = None
+
+            new_tokens = [get_random_string(length=12, allowed_chars='1234567890') for _ in range(10)]
+            request.session['pretix_2fa_new_emergency_tokens'] = new_tokens
+        return super().get(request, *args, new_emergency_tokens=new_tokens, static_tokens_device=static_tokens_device, **kwargs)
+
     def post(self, request, *args, **kwargs):
+        notices = [
+            _('Two-factor authentication has been enabled.')
+        ]
+        if 'pretix_2fa_new_emergency_tokens' in request.session:
+            d = StaticDevice.objects.create(user=self.request.user, name='emergency')
+            for code in request.session['pretix_2fa_new_emergency_tokens']:
+                d.token_set.create(token=code)
+            self.request.user.log_action('pretix.user.settings.2fa.regenemergency', user=self.request.user)
+            notices += [
+                _('Your two-factor emergency codes have been regenerated.')
+            ]
+            del request.session['pretix_2fa_new_emergency_tokens']
         self.request.user.require_2fa = True
         self.request.user.save()
         self.request.user.log_action('pretix.user.settings.2fa.enabled', user=self.request.user)
         messages.success(request, _('Two-factor authentication is now enabled for your account.'))
-        self.request.user.send_security_notice([
-            _('Two-factor authentication has been enabled.')
-        ])
+        self.request.user.send_security_notice(notices)
         self.request.user.update_session_token()
         update_session_auth_hash(self.request, self.request.user)
         return redirect(reverse('control:user.settings.2fa'))