Two-factor authentication

Two-factor authentication means that logging in needs your password and a second proof. Someone who steals your password still cannot get in. Open Security in the member menu to set it up.

Methods

• Authenticator app. An app such as Aegis, 2FAS, Authy or Google Authenticator makes a 6-digit code that changes every 30 seconds.
• Email code. We email a 6-digit code to your account address when you log in. It works for 10 minutes and once. This needs your email to work properly.

You can turn on either one or both.

Turning on an authenticator app

1. On the Security page press Set up.
2. Scan the picture with your app, or type the key into the app by hand.
3. Type the 6-digit code the app shows, enter your current password, and press Turn on.

The first method you turn on also gives you ten recovery codes. They are shown once. Save them somewhere safe. See the guide on recovery codes and trusted devices.

Turning on the email code

1. Press Send me a code. We email a code to your address to prove it works.
2. Type the code, enter your current password, and press Turn on.

Logging in

After your password you are asked for a code. You can use a code from your app, an emailed code, or a recovery code. If you tick the box to remember the device, you are not asked again on that browser for 30 days.

Limits and safety

Too many wrong codes lock the second step for a while, and even a right code is refused during the lock. After five wrong tries, wait 15 minutes. Every refusal shows the same message.

Some sensitive actions ask you to confirm a code again if you did not do so in the last 15 minutes. These include changing your password, adding or removing an SSH key, paying, changing two-factor settings, and some vault and chat encryption actions.

Turning it off

On the Security page turn off the method. You need your current password. Turning a method off also forgets your trusted devices.

Locked out?

See the troubleshooting guide on being locked out of two-factor.