# Set up two-factor sign-in

After this page, your sign-in requires a code from your authenticator app in addition to the password, and you have stored your recovery codes safely.

> **Type:** guide
> **For:** every person with an account in the portal
> **Prerequisite:** your current password and an authenticator app on your phone or computer
> **Where in the portal:** **Settings › My account › Security**, **Two-factor authentication** card

The second factor is optional but strongly recommended: “A second factor protects your account even if your password falls into the wrong hands.” It is mandatory for emergency accounts of an organization with enforced company sign-in. The card shows **Active** or **Not set up**.

## Steps

### Set up

1. Open **Settings › My account › Security** and click **Set up** in the **Two-factor authentication** card.
2. The dialog **Set up two-factor sign-in** first asks for confirmation: Enter your current password under **Password to confirm** and click **Continue**.
3. A QR code appears, with a secret as text next to it. Scan the code with your authenticator app or enter the secret there by hand.
4. Enter the first six-digit **Confirmation code** from the app and click **Confirm**.

### Store the recovery codes

Right afterwards, the block **Recovery codes — visible only now** appears with the addition “Store them safely; each code works exactly once.” Save the codes in a place you can reach even without your phone, such as a password manager or a printout kept locked away. If you lose your device, such a code is the only way back into your account. Click **Got it** to close the block. After that, the portal does not show it again.

You can generate new codes at any time with **Regenerate** in the card. The confirmation prompt says what that costs: “The previous codes expire in the process. Confirm with a current code from your authenticator app.” After that, the one-time block with fresh codes appears again.

### Turn it off

Click **Disable**. The dialog **Turn off two-factor sign-in** asks for proof: **Code from the app** or **Recovery code**. After you confirm, your password alone is enough to sign in again.

## Options

At sign-in, the **Confirmation code** page follows the password: six digits from the app, then **Confirm**. If you do not have the app at hand, **Use a recovery code** takes you to the second option, a code in the format `XXXX-XXXX-XXXX`. “Used codes expire.” If all of them are used up, set up the second factor again.

Sign-in link and company account replace the password, not the second factor: Even after **Sign in with company account**, the confirmation page follows. If the platform detects that a sign-in was stolen, it ends the session instead of renewing it, and you then sign in again.

## Check the result

- The card shows **Active** and below it: “At every sign-in we additionally ask for a code from your authenticator app.”
- The message “Two-factor enabled” appears. After regenerating, “New recovery codes generated” appears, and after turning it off, “Two-factor disabled”.
- Sign in once more in a private window: After the password, the **Confirmation code** page must appear.

## If something goes wrong

| Symptom | Meaning | Solution |
|---|---|---|
| “Invalid code” | The code has expired, or the clock of your device is off. | Wait for the next code and turn on the automatic time setting of the device. |
| “Setup failed” | Usually a wrong confirmation password in the first step. | Enter the password again. When in doubt, change the password first. |
| “Recovery code is invalid or already used” | Each code works exactly once, and older sets expire when you regenerate. | Use a different code from the current set. |
| Authenticator app gone and codes lost | A colleague suspending and reactivating the account does not reset the second factor. | Contact platform operations. Only they can release the factor. |
| For an emergency account, enforcement cannot be turned on | Next to the address, it says “no second factor set up”. | Set up the second factor here first, then try enforcing again. |

## Related

- [Change or reset your password](/docs/organization/password)
- [What does enforcing company sign-in mean?](/docs/organization/about-sign-in-enforcement)
- [Support: where to turn, what to include, and how we help](/docs/help/support)