Two-Factor Authentication
A code from your phone at sign-in, before a password change, before turning it off, and before deleting your account - and the codes that get you back if you lose it.
Security, in the sidebar of your account, is where you turn on a second step: a six-digit code from an authenticator app, on top of your password. It is asked for when you sign in, before your password changes, before you turn it off, and before either way of deleting your account.
Two-factor authentication
A second step when you sign in, change your password, turn this off, or delete your account, from an app on your phone. Recovery codes below are the way back if you lose it.
A six-digit code from 1Password, Authy or Google Authenticator. Works with no signal.
Ten one-time codes for when you lose the device. Store them somewhere that is not your phone — using one turns your authenticator off, so you can sign in with your password and set it up again.
Turning it on
Press Set up. Scan the square with 1Password, Authy, Google Authenticator or anything else that speaks TOTP - or copy the key underneath it if you would rather type it in. Then enter the code your app is showing and press Verify and turn on.
Two-factor authentication
A second step when you sign in, change your password, turn this off, or delete your account, from an app on your phone. Recovery codes below are the way back if you lose it.
A six-digit code from 1Password, Authy or Google Authenticator. Works with no signal.
Ten one-time codes for when you lose the device. Store them somewhere that is not your phone — using one turns your authenticator off, so you can sign in with your password and set it up again.
Codes refresh every 30 seconds, and there is a step of slack either side of that: the one that has just rolled over is still accepted, and so is the one about to appear. You do not have to race the change - watching the digits turn over while you type them is how a half-old, half-new code gets submitted.
A code stays live for about a minute - treat it like a password
That slack has a second effect worth knowing. A code is accepted for its own thirty seconds plus the step either side, so it is worth something for about a minute after your app first shows it.
Signing in with a code uses it up here. Enter the same one again on this site and the sign-in is undone - you land back on the sign-in page with:
That code had already been used to sign in, so it was refused and the sign-in was undone. Each code works once here - open your authenticator, wait for the next one, and sign in again with that.
Undone rather than refused, because of when we can tell. The check that catches a repeat happens just after your code is accepted, not before, so the only honest answer at that point is to take the sign-in back - which is what happens, and why you have to enter your password again.
The words "here" and "on this site" are doing real work. The service that checks your code does not track which ones it has already accepted, so we keep that record ourselves. It covers signing in through this site, which is how anyone would actually do it - but it is not a property of the code itself.
So still treat a code like a password for the minute it is alive: do not read it aloud, screenshot it, or paste it into a chat. It stops working on its own shortly afterwards, and it is useless to anyone who does not also have your password.
From then on, signing in asks for a code after your password. That screen names the account it is asking about, and Back to sign in at the top signs you out if you landed there by mistake.
Two-factor authentication
A second step when you sign in, change your password, turn this off, or delete your account, from an app on your phone. Recovery codes below are the way back if you lose it.
A six-digit code from 1Password, Authy or Google Authenticator. Works with no signal.
Ten one-time codes for when you lose the device. Store them somewhere that is not your phone — using one turns your authenticator off, so you can sign in with your password and set it up again.
Recovery codes, and what they actually do
A recovery code does not sign you in. It turns two-factor off.
There is no way for us to tell the sign-in that you proved yourself some other way, so a code cannot stand in for your authenticator. What it does instead is remove the authenticator, which puts your account back to a password sign-in so you can get in and set it up again.
That is the whole recovery. It is deliberate, and the screen says so before you press anything.
Press Generate codes and you get ten. They are shown once, on that screen, and there is no way to ask for them again - only to replace the whole list, which kills the old one.
Two-factor authentication
A second step when you sign in, change your password, turn this off, or delete your account, from an app on your phone. Recovery codes below are the way back if you lose it.
A six-digit code from 1Password, Authy or Google Authenticator. Works with no signal.
Ten one-time codes for when you lose the device. Store them somewhere that is not your phone — using one turns your authenticator off, so you can sign in with your password and set it up again.
Save these now. They are shown once and cannot be shown again — only replaced.
Each code works once. Generating a new set kills this one immediately.
Save them somewhere that is not the phone with your authenticator on it. A printout in a drawer beats a note on the device you are trying to recover from.
Once they are saved, press I've saved them securely to close the list. The badge keeps counting them - they are still your live set, just off the screen - and the only way to see codes again is Regenerate, which makes a new ten.
The Account readiness section, in the summary column down the right of every account page, lists this as one of four steps, so an account with two-factor on and no codes saved shows as unfinished there rather than only on this screen.
Each code works once, and the card carries a chip saying where you stand: none saved before you have any, 10 unused once you do, counting down as they are spent. With no codes and two-factor off it reads needs 2fa - the codes are a way back past the authenticator, so there is nothing for them to do until there is one.
Once generated, a set stays yours until you press Regenerate or spend the last one. Turning two-factor off does not touch it: the card keeps counting them, and they work again the moment an authenticator is back on.
If you lose your phone
At the sign-in code screen, choose Lost your authenticator?, and enter one of your codes. Two-factor turns off, you land in your account, and Security is waiting for you to set it up again on the new device.
Paste the code straight out of risbot-recovery-codes.txt - the field adds the hyphen,
uppercases what you type and ignores the spaces, so a line copied out of the file works as
it is. Back to sign in at the top is the only way off that screen: there is nothing to
go back to on the six-digit one if your authenticator is gone.
If you have no codes, nobody can get you back in
Generating codes is optional, and skipping it has a real consequence: an account with two-factor on, no codes, and no authenticator cannot be opened. Not by you, and not by support.
Generate them when you turn it on. It takes one press.
Two-factor authentication
A second step when you sign in, change your password, turn this off, or delete your account, from an app on your phone. Recovery codes below are the way back if you lose it.
A six-digit code from 1Password, Authy or Google Authenticator. Works with no signal.
Ten one-time codes for when you lose the device. Store them somewhere that is not your phone — using one turns your authenticator off, so you can sign in with your password and set it up again.
You have no codes. If you lose your authenticator now, nobody can get you back into this account — not even us.
If you still have the account but not the phone
Lost your device? sits beside Turn off on the authenticator row, and goes to a screen that spends a recovery code to switch the app off - the same thing the sign-in gate does, reached from the inside. Use it when the device is gone, replaced or wiped: Turn off itself is for a device you still have and no longer want.
It tells you how many codes are left before you spend one, and nothing about your bots changes - they answer Telegram and know nothing about this.
Once the code is accepted the screen stays where it is and says which one it spent and how many are still good, then offers Set up authenticator - that goes straight into the setup for the new phone. The codes you have left keep working with it; Regenerate on the Security page is what replaces them with a fresh ten, and it is a separate press.
Opening the screen when there is no authenticator on the account says so instead of asking for a code, so nothing is spent for nothing.
Turning it off
Turn off on the same card, while you are signed in. It asks twice: once to be sure, and then for a code from the app - a password on its own cannot remove the thing standing behind it. That is the last job the authenticator has.
Your recovery codes stay where they are and keep working if you turn it back on later; Regenerate is what replaces them.
When it is asked for
Signing in, changing your password, turning the authenticator off, and either way of deleting your account. The password one is the reason the second step is worth having at all: somebody holding a stolen password cannot use it to replace itself. The current password is checked first, then the code, and nothing is saved until both pass.
Deleting works the same way. You type the confirmation phrase, and the code is asked for after it - nothing is deleted or erased until the code checks out.
Unlinking Telegram, and connecting, rotating or revoking an exchange key, do not ask for a code today - if you want a second factor on those, say so and it can be added, but this page will not claim it until it is true.