# Secure your sign-in: two-factor, recovery codes, devices

<Lead>
Your account does not only hold your own data. Your workspace contains owner records, sale prices and your clients' credentials. A second factor makes sure a leaked password alone is not enough.
</Lead>

## What a second factor is

Signing in asks for two independent things: something you **know** (your password) and something you **have** (your phone). Anyone who guesses, intercepts or finds your password in a breach dump still cannot get in.

There are two levels today:

| Level | What it is | When it is active |
|---|---|---|
| **Confirmed email address** | Your address was confirmed with a code during registration | Automatically, on every self-created account |
| **Authenticator app** | A six-digit code that changes every 30 seconds | As soon as you set it up |

The authenticator app is considerably safer because it works independently of your mailbox. Anyone who gains access to your email can also trigger a password reset; they still cannot reach the app.

<Info title="SMS, push and passkeys">
We deliberately do **not** offer codes by SMS. SIM cards can be reassigned at mobile carriers, and that is the most common way an SMS code is stolen. Push approvals and passkeys are not available yet because the groundwork for them is still missing on our side. Once they arrive, you will read about it here.
</Info>

## Set up an authenticator app

You need an authenticator app on your phone. 1Password, Bitwarden, Google Authenticator and Microsoft Authenticator all work well. If you already use a password manager, it can almost certainly do this too.

<Steps>
<Step title="Open the setup">
Go to **Account > Security** and choose **Set up now** under "Two-factor authentication".
</Step>

<Step title="Connect the app">
**On a computer:** scan the QR code with your phone.

**On a phone:** tap **Open in app**. Your authenticator app opens and adds the account itself. You cannot scan your own screen, which is exactly why this route exists.

If neither works, copy the key below the code and enter it in the app by hand.
</Step>

<Step title="Confirm the first code">
Your app now shows a six-digit code that changes every 30 seconds. Type it in. If the code rolls over while you are typing, simply use the new one.
</Step>

<Step title="Save your recovery codes">
Right afterwards we show you ten recovery codes. **This is the only time you will see them.** How to store them is covered in the next section.
</Step>
</Steps>

## Recovery codes

Ten codes in the format `XXXXX-XXXXX`. Each one works **exactly once** and then replaces your authenticator app for a single sign-in.

They are your way back in when your phone is lost, broken or has been reset.

<Warning title="Without codes there is no quick way back">
If you have access to neither your authenticator app nor a recovery code, nobody can get you into your account quickly. Only the support route remains, and it takes time. Spend the two minutes now.
</Warning>

**How to store them properly:**

<Checklist>
<ChecklistItem>A **password manager** is the best place. Tap "Copy" and store them as a secure note.</ChecklistItem>
<ChecklistItem>**Printing** them and putting the sheet in a safe or a folder is perfectly fine too.</ChecklistItem>
<ChecklistItem>**Save as file** downloads a plain text file. Move it out of your downloads folder to somewhere you will find it again.</ChecklistItem>
</Checklist>

**What not to do:**

<Checklist>
<ChecklistItem>Do not mail them to **your own inbox**. Anyone taking over that mailbox would hold both halves at once.</ChecklistItem>
<ChecklistItem>Do not leave a **screenshot** in your photo library, which often syncs to the cloud unprotected.</ChecklistItem>
<ChecklistItem>Do not put them on a sticky note next to your screen.</ChecklistItem>
</Checklist>

**Account > Security** always shows how many codes are left. When the number gets low, generate a fresh set via **New codes**. Doing so invalidates **all** previous codes, including the unused ones. That is intentional: a set that no longer counts should not be lying around anywhere either.

## Signing in with a second factor

After your password or SSO we ask for the six-digit code from your app. Pasting works: the code distributes itself across the six fields and is checked right away.

If the code is wrong, the fields clear and you can type again immediately. After several failed attempts we slow things down briefly so nobody can work through codes by trial and error.

## Trust this device for 30 days

At the end of the setup, and on every sign-in, you can mark a device as trusted. On that device we will not ask for the second factor for 30 days. Your password is of course still required.

<Warning title="Only on devices that are genuinely yours alone">
Not on a shared office machine, not on a loaner, not in the training room. On a device like that, anyone holding your password would walk straight in without a second prompt.
</Warning>

**Account > Security** lists all trusted devices with their expiry date, and lets you withdraw trust from one or from all of them. The next sign-in on those devices asks for the code again.

Trust is withdrawn automatically anyway whenever your protection changes: on a password change, when you switch or re-create the authenticator app, and when a recovery code is used.

## Locked out? How to get back in

<Steps>
<Step title="Use a recovery code">
At the prompt choose **No access?** and then **Use recovery code**. Enter one of your ten codes. Capitalisation and the hyphen do not matter.

Afterwards we remove the old authenticator app from your account and take you straight into a fresh setup. That is deliberate: a device you no longer have is not something you can rely on.
</Step>

<Step title="Contact support">
If you are out of codes as well, support is the only remaining route. We review these requests personally, because a reset removes the whole protection. Allow some time for it.
</Step>
</Steps>

## For staff accounts: requiring two-factor

When the owner creates accounts for staff, each account can carry its own rule for how binding the second factor is. The setting lives under **Settings > Members**, inside the account under "Security".

| Setting | Effect |
|---|---|
| **Required** | No access without a second factor. The next sign-in goes through the setup first |
| **Recommended** | Suggested in the account settings, but skippable. Default |
| **Not required** | The account decides for itself |

<Tip title="Recommendation for accounts with vault access">
For seats allowed to open the credentials vault, **Required** is the right choice. Those seats hold other people's credentials, and a single password is too little for that.
</Tip>

Self-created private accounts do not have this setting. They always need at least a second factor; the confirmed email address satisfies that from day one.

## Stay signed in

The sign-in page carries a **Stay signed in** checkbox. It is on by default and keeps your session alive after the browser is closed.

Clear it on shared or borrowed devices. Your session then ends as soon as the browser closes.

## Related pages

- [My account](/help/howto/mein-konto): profile, appearance, usage and workspaces
- [Data handling and security](/help/grundlagen/datenhaltung-und-sicherheit): where your data lives and how it is protected
- [Workspace and roles](/help/grundlagen/workspace-und-rollen): who is allowed to do what in the office