How do I turn on two-factor authentication?

How do I turn on two-factor authentication?

1. Open Security. Go to Settings → Security. The first card is Two-factor authentication and shows a Disabled badge.
2. Click Enable 2FA. A Scan with your authenticator app card appears with a QR code.
3. Scan it. Open your authenticator app and add an account by scanning. Any TOTP app works — Google Authenticator, Authy, 1Password, Bitwarden and Microsoft Authenticator are all fine. If the camera will not cooperate, use the text secret under Can't scan the code? Enter manually.
4. Confirm. Type the 6-digit code from the app into 6-digit code from app and click Confirm.
5. Save your backup codes. Ten codes appear under Save these backup codes now. Click Copy all, store them somewhere safe, then click I've saved them.

What are the 10 backup codes for?

Each backup code is 8 digits, printed as 1234-5678, and works exactly once in place of the code from your authenticator app. They exist for the day your phone is lost, wiped or replaced.

The Security page tells you how many are left — "Unused backup codes: 7 of 10". It warns you below three and turns the count red at zero. When you are running low, click Regenerate backup codes and enter a current code. Regenerating replaces the whole set: the old ten stop working immediately, including any you have not used.

What does signing in look like afterwards?

Enter your email and password as usual, or click the Google button. Instead of landing in the dashboard you get a page headed Two-factor authentication with a single Authentication code field. Type the 6-digit code from your app and click Verify.

If you do not have your phone, type one of your 8-digit backup codes in the same field instead — the page accepts either. ← Back to sign in takes you back to the email and password step.

How do I turn two-factor off?

1. Go to Settings → Security.
2. Click Disable 2FA.
3. Enter a current 6-digit code from your authenticator app, or an 8-digit backup code, and confirm.

Proving you still hold the second factor is required to switch it off, so nobody who only has your password can remove it. The same proof is required to regenerate backup codes.

Common problems

The app's code is always rejected

TOTP codes are tied to the clock. If your phone's time has drifted, every code will be wrong. Turn on automatic date and time on the phone, then try the next code the app generates.

I lost my phone and my backup codes

There is no self-service recovery — that is the point of a second factor. Email support@qrcodestack.com from the address on the account and we will verify you manually.

I want to require 2FA for my whole team

Two-factor is a personal setting; each person turns it on for their own account. Enabling and disabling it is recorded, so an administrator can confirm who has done it under the Auth / 2FA events filter in the audit log.

I changed my password — do I have to set 2FA up again?

No. Changing or resetting a password signs you out everywhere, but your authenticator secret and remaining backup codes are untouched.

Frequently asked questions