Two-Factor Authentication
An extra step at login that keeps your website secure even if your password is stolen.
Two-factor authentication, often shortened to 2FA, asks for a short code from your phone in addition to your password. It means that someone who has your password still cannot get into your website without your phone. If two-factor authentication has been enabled on your site, this page walks you through setting it up and what to do if you ever get stuck.
Why Two-Factor Authentication
A password is a single thing that can be guessed, reused, or stolen in a data breach somewhere else entirely. Once someone has it, nothing stands between them and your website.
Two-factor authentication adds a second thing, and it is one that lives on a device you are holding. Even if your password is compromised, an attacker cannot log in without the code changing on your phone every 30 seconds.
The cost to you is a few extra seconds at login, and on computers you use regularly, usually not even that. See Logging In Day to Day below.
Setting Up Your Authenticator App
The code comes from an app on your phone or from your password manager. You have most likely already got one of these. Any of them will work:
- 1Password, Bitwarden, or another password manager with a built-in authenticator
- Google Authenticator
- Microsoft Authenticator
- Authy
- Duo
If you already use a password manager, use that one. It keeps your password and your login code together, and it syncs to your other devices, so replacing your phone does not mean starting over.
Step by step
When you log in and the setup wizard appears:
- Choose the one-time code option.
- A square QR code appears on screen. Open your authenticator app, use its scan or add account option, and point your camera at the code. If you cannot scan it, the screen also shows a text code you can type in instead.
- Your app now shows a six-digit number that changes every 30 seconds.
- Type the current number into the website to confirm the setup.
That is it. From now on, logging in asks for your password and then that six-digit code.
Backup Codes
Backup codes are single-use codes that let you log in when you cannot get to your authenticator app. A dead battery, a phone left at home, a device that has been replaced.
You will be offered a list of them right after setup. Take it. Each code works once, and they are the difference between a minor inconvenience and being locked out of your own website.
Where to keep them
Store them where you keep your other credentials, ideally in your password manager. Do not keep them only on the phone that has your authenticator app on it, because that is the one thing likely to be missing when you need them.
Running low
Each code disappears once it is used. You can generate a fresh list at any time from your profile page on the website, which replaces any codes you have left.
Logging In Day to Day
You will not be asked for a code every single time you log in. On a computer you use regularly you can choose to trust the device, and it will not ask again for about a month.
Only do this on a machine that is yours and that other people cannot use. Public computers, shared workstations, and anything in a coworking space should never be trusted this way.
If You Get Locked Out
It happens, and it is fixable. Work through these in order.
1. Use a backup code
Enter one of your backup codes instead of the six-digit code. Once you are in, go to your profile page and set up your authenticator app again on your new device.
2. Ask your site administrator
If your organization has someone who manages the website, they can reset two-factor authentication on your account so you can set it up fresh.
3. Contact us
If you have run out of backup codes and there is nobody on your team who can reset it, open a support ticket and we will reset two-factor authentication on your account. We will confirm who you are before making that change, so please use an email address we already have on file for you.
Frequently Asked Questions
Do I need to buy anything?
No. The authenticator apps listed above are free, and if you already use a password manager it can almost certainly generate the codes for you.
What happens when I get a new phone?
If your codes come from a password manager, they move with your account and there is nothing to do. If you used a standalone authenticator app, set it up again on the new phone from your profile page before you get rid of the old one. If the old phone is already gone, use a backup code to get in.
Do I need my phone to have signal?
No. The six-digit code is generated on the device itself, so it works with no signal and no internet connection. It is not a text message.
Can I use text messages instead?
We recommend an authenticator app. Codes sent by text can be intercepted by redirecting your phone number, which is a real and reasonably common attack, so an app on your device is meaningfully safer.
What if the code is rejected even though I typed it correctly?
Codes are tied to the clock, so this is nearly always a time problem on the phone. Turn on automatic date and time in your phone settings, then try again with a freshly generated code.
Does everyone on my team have to use this?
That depends on how your site is configured. Two-factor authentication is usually required for accounts that can change the website, and it can be set to apply to some roles and not others. If you are not sure what applies to your team, get in touch and we will confirm the setup on your site.