This page covers two-factor authentication (2FA) for an AliasFleet account: setup with an authenticator app, sign-in with a code, storage of recovery codes, and removal of 2FA. Two-factor authentication adds a second sign-in step, so a password on its own does not open the account.
What is two-factor authentication?#
Sign-in under two-factor authentication requires two separate items: the account password and a code that changes with time. The password is entered first, and a 6-digit code is then requested. That code is produced by an authenticator app on a phone, or, where the email method is selected, sent as a one-time passcode to the account email. The authenticator app is the more secure method, because it does not rely on the security of an inbox. A password that is exposed does not by itself open the account, because the second item is still required.
An authenticator app must be installed on a phone before setup starts. The recovery codes shown at the end of setup must also be saved before that screen is left, because they provide the backup route back into the account if the authenticator app is lost.
How is 2FA set up with an authenticator app?#
Setup has five steps, completed in Settings, and ends with recovery codes that must be saved before the setup screen is closed.
- Open Security settings. Go to Settings → Security and select Enable 2FA.
- Choose the authenticator app method. Select Authenticator App and then select Continue.
- Scan the QR code. Scan the QR code shown on screen with the authenticator app. The app then generates a 6-digit code that changes every 30 seconds.
- Confirm the code. Enter the current 6-digit code from the app to confirm that setup works.
- Save the recovery codes. Save the set of one-time recovery codes shown, in a password manager or printed and kept in a secure physical location, before leaving the screen.
Recovery codes can be replaced at any time from Settings → Security if the existing set is believed to be compromised. Regeneration replaces the old set in full.
What if email codes are preferred instead?#
At setup, email one-time passcode is offered as an alternative. Under that method, a code is sent to the account email at every sign-in. Sign-in then depends on access to that inbox, which makes the method less convenient and less secure than an authenticator app. The authenticator app method is therefore the recommended choice where a phone app is available.
How is sign-in completed with 2FA turned on?#
Sign-in with 2FA follows the same two steps every time: the account password is entered, and then the current code is entered.
- Enter the password. Sign in with the account email address and password as usual.
- Enter the 2FA code. Open the authenticator app and enter the current 6-digit code. If the authenticator app is unavailable, enter one of the saved recovery codes instead. Each recovery code works once.
If a code is rejected, the phone clock should be set automatically, because time-based codes depend on an accurate clock. Trying the code at the start of its 30-second window also helps. Full lockout steps are covered in Can't Log In.
How is 2FA disabled?#
Disabling 2FA removes the second sign-in step and invalidates all existing recovery codes. After disabling, sign-in requires only the password.
- Open Security settings. Go to Settings → Security and select Disable 2FA.
- Confirm with a code. Enter a current 2FA code to confirm the change.
New recovery codes are issued if 2FA is enabled again later.
How is access recovered after a lockout?#
Recovery depends on what is still available. If recovery codes were saved, one recovery code signs in, and 2FA can then be disabled and set up again on the new device. If the authenticator app and the recovery codes are both lost, the remaining route is support: contact support and be prepared to verify identity as the account owner. The detailed lockout steps, including clock-sync fixes for rejected codes, are in Can't Log In.
Related guides#
- Can't Log In: fixes for failing 2FA codes, lost authenticators, and lost recovery codes.
- Security Best Practices: the wider account security setup, including 2FA alongside password and alias habits.
- How to Secure Your Email Account: why two-factor authentication comes before other account security steps.