Second steps
A second step is what the panel asks for after a correct password, so a stolen password alone can't sign you in. The Second Steps section of the Password & Security page lists each one with an On or Off badge.
Two facts decide when the panel asks for one:
- Only a sign-in with a password asks. A sign-in with a passkey never does, because the passkey does both steps at once.
- Only the authenticator app turns the second step on. The other items in this section stand in for the app's code and don't work without it.
An account without a password has no Second Steps section; there's nothing for a second step to protect.
The authenticator app
The authenticator app makes a new six-digit code every 30 seconds, and the panel asks for the current one after your password. Any app that supports TOTP codes works, e.g. Google Authenticator or a password manager.
| Action | What happens |
|---|---|
| Set Up an Authenticator App | Scan the QR code with the app and type a code from it. The app is on once the panel accepts that code; the panel then makes and shows ten backup codes. |
| Manage, then Set Up Again | For a new phone, a lost device, or when somebody else may have a copy of the app. You scan a new key; the old one works until you finish. Your backup codes don't change. |
| Manage, then Turn off | The panel stops asking for a second step. The page lists every effect before you confirm. |
Each of these asks you to confirm your identity first, and each change sends an email to your System Mailbox.
When you turn off the app:
- anyone who knows your password can sign in with it alone;
- your backup codes stop working;
- your devices stop approving your sign-ins, but keep sending sign-in alerts.
Some apps copy their codes to a new phone. If yours did, the old setup keeps working and you don't need Set Up Again.
Backup codes
A backup code signs you in once, in place of the code from the app, for the day you can't use your phone.
- The panel makes ten when you set up the app. A code has ten characters,
e.g.
k7m2q-9xw4d; upper case, lower case, and the hyphen are all accepted. - Type one at the prompt for the app's code. Each works once.
- On the Backup Codes page you can show the codes again or make a new set with Generate New Codes, after confirming your identity. A new set stops the old codes, and the panel emails you about it.
Store the backup codes outside the account they protect. A file in your home directory on this server doesn't help when you can't sign in.
The yearly check
A year after you last looked at your backup codes, the panel asks after sign-in: Do You Still Have Your Backup Codes? It also asks when you use your last code.
| Answer | Result |
|---|---|
| I Still Have Them | Asked again in a year. |
| View My Codes or Make New Codes | Opens the Backup Codes page. |
| Remind Me Later | Asked again in seven days. |
Trusted devices
At the code prompt, you can select Trust this device for 30 days, and that browser isn't asked for a code for 30 days.
All trusted devices are forgotten when:
- you change or remove your password;
- you set up the authenticator app, set it up again, or turn it off;
- you select Revoke in the Trusted Devices row.
The Trusted Devices row appears while the authenticator app is on. After a revocation, every browser asks for a code at its next sign-in with your password.
A passkey as the second step
If you have both the authenticator app and a passkey, the code prompt shows Use a passkey, for when you started with your password but your passkey is closer than your phone. The passkey completes the sign-in in place of the code.
A sign-in that starts with a passkey never reaches this prompt. Sign in with Passkey on the sign-in page is the shortest way in.
Approve on another device
A device that approves sign-ins can also stand in for the code. After your password, the panel sends a request to your devices and shows a number; open the notification on your phone and select the same number.
A device can approve your sign-ins only while the authenticator app is on. A notification can arrive late or not at all, depending on your browser and the browser maker's service, so an approval is never your only second step. If the request doesn't arrive, select Use your authenticator app and type the code.