Two-factor authentication
On this page
Two-factor authentication is the second lock on your account, next to passkeys and your password. It needs a connection to your server; offline it's shown read-only.
Turn on two-factor authentication#
With two-factor authentication, signing in takes your password plus a six-digit code from an authenticator app on your phone. Any app that supports time-based codes works.
- Open Settings → Account → Two-factor authentication and select Set up two-factor authentication.
- Scan the QR code with your authenticator app, or type in the key shown under it.
- Enter the six-digit code the app shows.
- Save the recovery codes that appear. They're shown only once: download them as a text file or write them down and keep them somewhere safe.
From then on, sign-in asks for a code after your password. Signing in with a passkey skips the code, because the passkey already checks it's you.
Remember this browser#
When you enter a code, you can tick Remember this device for 30 days so that browser doesn't ask again for a month. The list of remembered browsers is under Two-factor authentication, where you can forget them.
Recovery codes#
Each recovery code works once, in place of a code from the app. Use one if you lose your phone. Settings shows how many you have left and lets you generate a new set, which replaces the old one.
If you lose both your phone and your recovery codes, the owner of your server can reset your two-factor authentication.
Your server's owner can also make two-factor authentication required. If so, you'll be asked to set it up when you sign in, and you can't turn it off.
Turning two-factor authentication off asks for your password or a code again, unless you entered one in the last ten minutes (Confirm it's you).