Two-factor

Two-factor adds a second step to signing in, so a stolen password is not enough on its own. You need an authenticator app on your phone for it.

Open Two-factor

Who has to use it

Two-factor is required for anyone who may invite or manage people, or change the property or the billing. It hangs on those rights, not on the name of your role. Anyone who may only view, or who does the daily work, does not have to.

If it is required for you, you first get fourteen days. The screen says how many days you have left. After that you get no further in the dashboard than this screen until two-factor is on. There is no extra charge.

Turning it on

1. Enter your password and click "Get started".
2. Scan the QR code with your authenticator. On your phone, use "Open my authenticator" instead. If scanning does not work, type the secret in by hand; "Copy" puts it on your clipboard.
3. Write down the recovery codes, or copy them with "Copy the codes", and keep them away from your phone: on paper, or in a password manager on another device. You see them once; after that we cannot read them either. A code like this gets you back in if you lose your phone.
4. Enter the six-digit code from your app, tick "I have saved my recovery codes somewhere other than this phone" and click "Confirm". Without that tick two-factor does not turn on: recovery codes on the same phone as your authenticator do not help once that phone is gone.

After that it says two-factor is on, and your other devices are signed out: a device that never showed the code from your app does not stay in. Sign in there again, now with the code.

Signing in with two-factor

After your password, the sign-in screen asks for the six digit code from your app under "One more step". That also applies when you sign in with a code from your email, and after a new password: those prove your address, not your phone. Lost your phone? Type one of your recovery codes instead; each recovery code works once. If the second step takes longer than ten minutes, you start again with your password.

Two-factor and passkeys

A passkey (Your profile) is another way in: signing in with a passkey does not ask for the code from your app, because a passkey is two steps already (your device, and unlocking it). It does not count as two-factor: if two-factor is required for you, you switch it on with an authenticator app, also when you have a passkey. That also gives you recovery codes, and those stay your way back if your device is gone.

Lost your phone

1. Sign in on another device with your password, and under "One more step" type one of your recovery codes. Each code works once.
2. Then turn two-factor off and on again with your new phone, or make new recovery codes (below).

If your recovery codes are gone too, email us at the address shown on this screen and under "One more step". Once we are sure it is you, usually by calling back on the number we know for your property, we switch two-factor off and remove your passkeys, because they may be on the lost phone. You are signed out on every device and get an email. Sign in with your password and switch two-factor on again straight away.

New recovery codes

With two-factor on, enter your password under "New recovery codes" and click "Make new recovery codes". You see the new set once; the old codes stop working. Do this when you have used a few codes, or no longer know where they are.

Turning it off

Enter your password and click "Turn two-factor off". If two-factor is required for you, you then get no further than this screen.

Good to know

• If the code is not accepted, check you have the latest one; your app shows a new one every thirty seconds.
• This screen is not in the bar. You get there through this handbook, or because the dashboard sends you there.
• What everyone on your team may do is on Your profile.
• Two-factor cannot be turned on for the account behind the demo button: its password is public, and nobody else could get in.