Signing In with Multi-Factor and Using Recovery Codes

Availability: all plans

Once multi-factor authentication is on, signing in takes two steps: your password, then a code. This guide explains the second step, what to do when you cannot use your authenticator app, how to replace your recovery codes, and how long a sign-in lasts. The same pages are used by providers, their team and customers.

Before you start

You need multi-factor authentication turned on for your account (see the guide on turning it on) and either your phone with the authenticator app or one of your saved recovery codes. Multi-factor sign-in is included in every plan.

Steps

To sign in:

1. On the Sign in page, enter your credentials. Tick Remember me if you want a longer sign-in.
2. When your password is accepted, you are taken to Verify your sign in, which asks you to enter your authenticator code or a recovery code.
3. Type the six-digit code from your app into Verification code and choose Verify. Spaces and dashes are ignored.

To sign in with a recovery code instead:

1. On Verify your sign in, tick This is a recovery code.
2. Type one saved code into Verification code and choose Verify. That code cannot be used again.

To replace your recovery codes:

1. Open Security, then Multi-Factor Auth. While multi-factor is enabled, the page shows a box headed Recovery Codes with how many remain. When two or fewer are left it turns red and says you are running low.
2. Choose Generate new recovery codes.
3. On Generate new recovery codes, enter your current code in Authenticator code and choose Generate new recovery codes. All earlier codes stop working immediately.
4. Save the new set with Download codes or Copy codes, then choose I've saved my codes — continue.

To sign out other devices:

1. Open Security, then Sessions. The page lists each session with its device, IP address and when it was last active, and marks yours This device.
2. Choose Sign out all other sessions. The link appears only when another session exists.

Tips

How long you stay signed in depends on Remember me. With it ticked, a sign-in lasts 14 days. Without it, it lasts one hour. Generate fresh recovery codes as soon as you use one or two, before you are down to the last few. If you see a session you do not recognise on Sessions, sign out the others and change your password.

If something goes wrong

If Verify your sign in says the verification code is invalid, make sure you ticked This is a recovery code only when entering a recovery code, and that your phone clock is correct. Each wrong attempt counts as a failed sign-in, so avoid guessing repeatedly. If the verification page sends you back to Sign in, the check expired, so start the sign-in again. If you have no phone and no recovery codes left, contact ServiceVisit support to have two-factor authentication reset on your account.

Related articles

• Turning On Multi-Factor Sign-In for Your Account — Multi-factor authentication adds a second step to signing in. After your password, you also enter a six-digit code from an authenticator app on your phone, so a stolen password alone cannot open your…