Docs / Account

Two-factor authentication

Protect your account with an authenticator app, and what your backup codes do.

Turning it on

Two-factor authentication works with any authenticator app. Scan the code your dashboard shows, enter the six digits it gives back, and it is on.

Codes6 digits, new every 30 seconds

Appsany authenticator that reads a QR code

There is nothing to install and nothing proprietary here: the code is a standard one, so whichever app you already use will do.

Signing in with it

With 2FA on, signing in asks for your password and then for a code, on a page of its own. The neighbouring code is accepted as well as the current one, so a phone whose clock has drifted slightly still works.

Attempts5 per 5 minutes

Run out and the step is closed for a while. It is the guess that is rate limited, not you: your password is still correct and your account is untouched.

Backup codes

Turning 2FA on gives you 3 backup codes. Write them down somewhere that is not the phone holding the authenticator.

A backup code works once, and using one turns 2FA off. That is deliberate. A lost phone should get you back into your account rather than into a second puzzle, so the code that lets you in also clears the thing you can no longer answer. Turn 2FA back on from your dashboard and you get a fresh set.