Two-factor authentication

This page explains how to protect your account with a second step at sign-in: an authenticator app, one-time backup codes, and codes sent by email.

What two-factor authentication does

Two-factor authentication (2FA) means signing in takes your password plus a one-time code that only you can get. Someone who learns your password still cannot sign in without the code. It is the single best thing you can do to protect your account.

EyalSec offers two kinds of second factor, and you can use either or both: an authenticator app on your phone, and codes sent to your recovery email. You manage them on the Two-factor authentication page of Settings. What the sign-in step looks like is on Sign in.

Authenticator app

An authenticator app (such as Google Authenticator, 1Password or Authy) shows a new 6-digit code every 30 seconds. Once it is set up, EyalSec asks for the current code each time you sign in. The Authenticator app box shows on or off.

Turn it on

You turn the authenticator app on by scanning a QR code and proving it works with one code.

1. Open Settings > Two-factor authentication and, under Authenticator app, click Enable 2FA.
2. The Set up authenticator app screen shows a QR code. Scan it with your app, or type the Manual key shown under it.
3. Enter the 6-digit code the app shows under Enter the 6-digit code, and your password under Confirm password.
4. Click Verify & enable.

If the code is wrong, the page says "That code didn't match. Try again." and keeps the same QR code. When it works, your backup codes appear, and every other browser signed in to your account is signed out.

Turn it off

Turning the authenticator app off removes it and your backup codes from the account. Under Authenticator app, enter your password under Confirm password to disable, and click Disable 2FA.

Your account then goes back to password-only sign-in, unless email sign-in codes are on. Other browsers are signed out, and a notice goes to your recovery email.

Backup codes

Backup codes let you sign in when your phone is not at hand. You get 10 of them when you turn on the authenticator app, each looks like 7K3M-9QXA-2WDF-HN4P, and each works once.

They are shown only once, in a panel titled Your backup codes: save these now. Copy them to a safe place, such as a password manager, then click I've saved these. EyalSec keeps only a scrambled form and cannot show them again.

The Backup codes box, shown while the authenticator app is on, tells you how many are left (for example 7 left); it turns amber below 3. At sign-in, click Use a backup code instead to use one. A backup code is also accepted wherever Settings asks for a 2FA code.

Regenerate backup codes

Regenerating gives you a fresh set of 10 and cancels every unused code from the old set. Do it when you are running low or think the codes may have been seen by someone else.

Under Backup codes, enter your password under Confirm password to regenerate backup codes, and click Regenerate backup codes. Save the new set the same way; a notice goes to your recovery email.

Email sign-in codes

Email sign-in codes send a one-time 6-digit code to your recovery email when you sign in. With an authenticator app, they are an extra way in when your phone is not available; without one, the emailed code is your second factor on its own.

To turn them on, go to Email sign-in codes, enter your password under Confirm password to enable, and click Enable email codes. You need a recovery email first; without one the box links to the Account page to add it. To turn them off, enter your password and click Disable email codes. Both changes sign out your other browsers.

At sign-in, click Email me a code (or Send code to my email) and enter the code from the email.

• A code is valid for 10 minutes and works once.
• You can ask for a new code once a minute; asking sooner says a code was already sent.
• After five wrong tries the code stops working; ask for a new one.

Removing your recovery email turns email sign-in codes off automatically.

If you lose access

If you lose your phone, sign in with a backup code or an email code, then turn the authenticator app off and on again to set up the new phone. Resetting your password does not turn off two-factor authentication.

If you have lost your phone, used every backup code, and do not have email sign-in codes on, email support@eyalsec.com from your recovery address.