Your account does not only hold your own data. Your workspace contains owner records, sale prices and your clients' credentials. A second factor makes sure a leaked password alone is not enough.
What a second factor is
Signing in asks for two independent things: something you know (your password) and something you have (your phone). Anyone who guesses, intercepts or finds your password in a breach dump still cannot get in.
There are two levels today:
| Level | What it is | When it is active |
|---|---|---|
| Confirmed email address | Your address was confirmed with a code during registration | Automatically, on every self-created account |
| Authenticator app | A six-digit code that changes every 30 seconds | As soon as you set it up |
The authenticator app is considerably safer because it works independently of your mailbox. Anyone who gains access to your email can also trigger a password reset; they still cannot reach the app.
Set up an authenticator app
You need an authenticator app on your phone. 1Password, Bitwarden, Google Authenticator and Microsoft Authenticator all work well. If you already use a password manager, it can almost certainly do this too.
Open the setup
Go to Account > Security and choose Set up now under "Two-factor authentication".
Connect the app
On a computer: scan the QR code with your phone.
On a phone: tap Open in app. Your authenticator app opens and adds the account itself. You cannot scan your own screen, which is exactly why this route exists.
If neither works, copy the key below the code and enter it in the app by hand.
Confirm the first code
Your app now shows a six-digit code that changes every 30 seconds. Type it in. If the code rolls over while you are typing, simply use the new one.
Save your recovery codes
Right afterwards we show you ten recovery codes. This is the only time you will see them. How to store them is covered in the next section.
Recovery codes
Ten codes in the format XXXXX-XXXXX. Each one works exactly once and then replaces your authenticator app for a single sign-in.
They are your way back in when your phone is lost, broken or has been reset.
How to store them properly:
- A password manager is the best place. Tap "Copy" and store them as a secure note.
- Printing them and putting the sheet in a safe or a folder is perfectly fine too.
- Save as file downloads a plain text file. Move it out of your downloads folder to somewhere you will find it again.
What not to do:
- Do not mail them to your own inbox. Anyone taking over that mailbox would hold both halves at once.
- Do not leave a screenshot in your photo library, which often syncs to the cloud unprotected.
- Do not put them on a sticky note next to your screen.
Account > Security always shows how many codes are left. When the number gets low, generate a fresh set via New codes. Doing so invalidates all previous codes, including the unused ones. That is intentional: a set that no longer counts should not be lying around anywhere either.
Signing in with a second factor
After your password or SSO we ask for the six-digit code from your app. Pasting works: the code distributes itself across the six fields and is checked right away.
If the code is wrong, the fields clear and you can type again immediately. After several failed attempts we slow things down briefly so nobody can work through codes by trial and error.
Trust this device for 30 days
At the end of the setup, and on every sign-in, you can mark a device as trusted. On that device we will not ask for the second factor for 30 days. Your password is of course still required.
Account > Security lists all trusted devices with their expiry date, and lets you withdraw trust from one or from all of them. The next sign-in on those devices asks for the code again.
Trust is withdrawn automatically anyway whenever your protection changes: on a password change, when you switch or re-create the authenticator app, and when a recovery code is used.
Locked out? How to get back in
Use a recovery code
At the prompt choose No access? and then Use recovery code. Enter one of your ten codes. Capitalisation and the hyphen do not matter.
Afterwards we remove the old authenticator app from your account and take you straight into a fresh setup. That is deliberate: a device you no longer have is not something you can rely on.
Contact support
If you are out of codes as well, support is the only remaining route. We review these requests personally, because a reset removes the whole protection. Allow some time for it.
For staff accounts: requiring two-factor
When the owner creates accounts for staff, each account can carry its own rule for how binding the second factor is. The setting lives under Settings > Members, inside the account under "Security".
| Setting | Effect |
|---|---|
| Required | No access without a second factor. The next sign-in goes through the setup first |
| Recommended | Suggested in the account settings, but skippable. Default |
| Not required | The account decides for itself |
Self-created private accounts do not have this setting. They always need at least a second factor; the confirmed email address satisfies that from day one.
Stay signed in
The sign-in page carries a Stay signed in checkbox. It is on by default and keeps your session alive after the browser is closed.
Clear it on shared or borrowed devices. Your session then ends as soon as the browser closes.
Related pages
- My account: profile, appearance, usage and workspaces
- Data handling and security: where your data lives and how it is protected
- Workspace and roles: who is allowed to do what in the office