Two-Factor Authentication

Two-factor authentication is a TOTP-based second factor that you enable from the /settings page. Once enabled, every subsequent login requires both your password and a 6-digit code from an authenticator app (Google Authenticator, Authy, 1Password, Bitwarden, etc.).

• 01Open /settings and click Enable on the Two-Factor Authentication card.
• 02Scan the displayed QR code with your authenticator app, or manually enter the secret string.
• 03Enter the 6-digit code your app shows to confirm setup.
• 04Download or copy your recovery codes. Each one can be used once if you lose access to your authenticator.

On the same card, the Disable action prompts for your current TOTP code before removing the second factor. Disabling invalidates all recovery codes — if you re-enable later, you receive a fresh set.

After a successful password check, the login page opens the 2FA dialog. Submit a TOTP code or, if you cannot reach your authenticator, switch the dialog to recovery-code mode and use one of your saved codes.