Two-factor authentication (2FA, also called multi-factor authentication or MFA) adds a second step to signing in. After your email and password, you enter a 6-digit code from an authenticator app on your phone. A stolen or guessed password is then no longer enough to get into your account.
Who needs this and by when
Your organization now requires 2FA. After the switch-on date in your notice you have a 14-day grace period. During it you can keep signing in with your email and password, and you will see a Set up two-factor authentication banner at the top of the page. When the grace period ends you cannot use the application until you have set up 2FA, so it is best to do it now. It takes about five minutes.
Note
Sign-in is now email and password only. If you used to sign in with a code sent to your email, select Forgot password? First time here? Set your password. on the sign-in page to choose a password first.
Before you start
You need:
your email and password,
a smartphone with an authenticator app, such as Google Authenticator or Authy (any app that supports one-time codes, also called TOTP, works), and
somewhere safe to keep your recovery codes, such as a password manager.
Set up your authenticator app
Select Set up authenticator app in the banner, or go to Account → Security and start setup there. You can also open the setup page directly at
/auth/mfa-enroll.If you are asked, confirm your password. This is a security check, not a problem with your account.
Open your authenticator app on your phone and add a new account. Scan the QR code on the screen. If you cannot scan it, choose the option to enter a key manually and type in the secret key shown below the QR code.
Your app now shows a 6-digit code that changes every 30 seconds or so. Type the current code into Enter the 6-digit code to confirm enrollment, then select Confirm and enroll.
Select Generate recovery codes and save them. This step is required to finish setup. See the next section.
Tip
Name the account so you can find it later, for example the name of the application and your email address.
Save your recovery codes
Recovery codes are your way back into your account if you lose your phone. You get a set of 10. Each code works only once.
Save them in a password manager, or use Download codes and keep the file somewhere private.
Do not keep them only on the phone that holds your authenticator app.
Do not share them. Anyone with your password and one recovery code can sign in as you.
Warning
You will not be shown the same recovery codes again. If you lose them, you can generate a new set from Account → Security. A new set replaces the old one.
Sign in with a code
Once 2FA is on, signing in has two steps:
Enter your email and password as usual.
On the Two-factor authentication screen, open your authenticator app, type the current 6-digit code into Authenticator code, and select Verify and sign in.
The code changes about every 30 seconds. If it is rejected, wait for the next code and try again, and check that your phone's clock is set automatically.
If you lose your phone
On the Two-factor authentication screen, select Use a recovery code instead.
Enter your email, your password and one of your saved recovery codes, then select Sign in with recovery code.
That code is now used up. You are asked to set up an authenticator app again, on your new phone. When you finish, save your new recovery codes.
If you have no phone and no recovery codes
Ask an administrator of your organization to reset your two-factor authentication. They do this under Admin → Users, using Reset MFA on your row. The next time you sign in, you will be asked to set up an authenticator app again.
Manage 2FA later
Go to Account → Security at any time to see whether 2FA is on, to generate a new set of recovery codes, or to set up 2FA early if you have not already.
Quick answers
I never see a code prompt after my password. Your 2FA is not set up yet. Look for the Set up two-factor authentication banner.
My code says it is invalid. Wait for the next code and try again. Make sure your phone's date and time are set automatically.
I forgot my password. Select Forgot password? First time here? Set your password. on the sign-in page.
I think someone else has my recovery codes. Sign in, go to Account → Security and generate a new set. That replaces the old ones.