Workspace · document 20

Two-factor Authentication

In the workspace: /two-factor/

Availability

Included on every plan, including the free trial

This document is open to every reader on every plan. Availability tells you what a plan includes; it does not decide what you may read.

What it is for

A password is one secret, and secrets leak in ways you never see: a reused password on another site, a stolen laptop, a phishing page that looked right. Two-factor authentication asks for a code from your phone as well, so a leaked password on its own is no longer enough to sign in as you. Recovery codes are the way back in when the phone is not to hand.

How to use it

Scan the code with an authenticator app, or type the secret in by hand if the camera will not cooperate. The secret is shown in groups of four so it can be transcribed without losing your place.
Confirm with a code from the app. Enrolment is not complete until the platform has seen one, because a secret you saved wrongly would lock you out at the next sign-in.
SAVE THE RECOVERY CODES SOMEWHERE THAT IS NOT YOUR PHONE. They are shown once. A password manager or a printed copy in a drawer both work; a screenshot on the same phone does not.
Trust this browser only on a machine that is yours. A trusted browser skips the code, which is convenient at your desk and a hole in a shared office.

Reading the result

The panel states whether two-factor is on, how many recovery codes remain unused, and which browsers currently skip the code. The remaining count is the figure to watch: it decreases silently every time one is used, and the page warns at two or fewer because running out means locking yourself out of your own account.

What it cannot tell you

It protects the sign-in, not the device: a phone that is unlocked in somebody else hands generates valid codes. Nobody at this platform can read your codes, which is exactly what makes them worth having, and it is why the third step above is written in capitals. If you lose the phone and the recovery codes together, the codes cannot be shown to you again and no support request can retrieve them: the operator can only switch the second factor off entirely, after which you sign in with your password alone and enrol again from the beginning. Your projects and reports are untouched by that, and you are emailed when it happens.

What it keeps

The enrolment secret, encrypted, and a one-way hash of each recovery code - so the platform can check a code you present and can never show you one. Trusted browsers are kept as revocable records you can end from this page at any time.