Two-factor authentication

Two-factor authentication adds a second check to every sign-in: after your password, or after Google or Microsoft returns you to the portal, you enter the 6-digit code your authenticator app shows for EchoNova. Turn it on from Settings in a few minutes. When you finish this page you will have it on, you will have your ten recovery codes saved somewhere safe, and you will know how to sign in with either the app or one of those codes.

What you need

An account you are signed in to. Every sign-in method can turn this on: email and password, Google or Microsoft.
An authenticator app on your phone or computer that scans a QR code and shows time-based codes, such as Google Authenticator or Microsoft Authenticator.
A place to keep the recovery codes that is not the same device as the app.

Steps

Open the user menu, choose Account settings, and select the Login and security tab. The Two-factor authentication card reads Add a code from an authenticator app on top of your password. with a chip that says Off or On.

Step 2: Scan the code and confirm

Press Enable. The dialog Enable two-factor authentication shows Setting up two-factor authentication… for a moment, then changes to Scan and confirm.
In your authenticator app, add an account by scanning the QR code shown. If you cannot scan, the box Can't scan? Enter this setup key manually holds the key; press Copy and paste it into the app. The entry appears in the app as EchoNova with your email address.
Type the 6-digit code the app now shows into the field under the key.
Press Enable. The dialog moves to Save your recovery codes.

You have 10 minutes from pressing Enable to confirm the first code. After that, the dialog answers Setup session expired; please restart enrollment; close it and press Enable again to get a new QR code.

Step 3: Save the recovery codes

The Save your recovery codes step shows ten codes, each 32 characters in eight groups of four, and this notice: Store these codes somewhere safe. They are shown only once. Each code works one time if you lose access to your authenticator app. Anyone with a code can pass two-factor, so keep them private.

Press Copy all to put them on the clipboard, or Download to save them as a text file. Tick I saved these codes somewhere safe, then press Done; Done stays disabled until the box is ticked. A toast confirms Two-factor authentication enabled, and the card's chip reads On.

The recovery codes are the only way through the sign-in check without your authenticator app. If you lose the device and have no unused code, you cannot complete a sign-in. Copy or download the codes before you press Done; they are never shown again. Each one works a single time, so treat them like passwords: keep them apart from the phone that holds the app, and if anyone else may have seen them, press Regenerate on the Recovery codes row to replace all ten.

From now on, each sign-in ends on the Two-factor authentication page: Enter the code from your authenticator app.

Open the app and read the current 6-digit code for EchoNova.
Type it into Authentication code and press Verify. The portal opens on Home, or on the page you were heading to.

The app's code changes every 30 seconds; the code from the step just before or just after is also accepted, so a phone whose clock is a few seconds off is fine.

Without the app, select Lost your device? Use a recovery code. The page changes to Enter your recovery code. with a Recovery code field. Typing a letter, a dash or a seventh character into Authentication code switches to this mode on its own. Enter one unused code with or without its dashes, in either case, and press Verify. That code is then spent. Use your authenticator app instead switches back.

Complete the check within 5 minutes of your password or provider sign-in being accepted. After that the code is refused; press Back to sign in and sign in again.

Step 5: Turn it off, or start over with a new app

Two-factor is turned off from the same card. Press Disable; the dialog Disable two-factor authentication asks you to Enter your current authentication code or a recovery code to turn off two-factor authentication. Enter either and press Disable. A toast confirms Two-factor authentication disabled, the chip reads Off, and the recovery codes stop working. Your sign-in sessions on other devices end; this browser stays signed in.

To move to a new phone or a new app, turn two-factor off and then on again. The card offers Disable while the chip reads On; once it reads Off, press Enable and scan with the new app. The new enrolment issues a new QR code and ten new recovery codes.

Step 6: Keep track of your recovery codes

While two-factor is on, the Login and security tab shows a Recovery codes row with how many are left, such as 8 recovery codes left. When one or none is left it adds You have 1 recovery code left. Regenerate to get 10 new ones. Press Regenerate, enter the 6-digit code from your authenticator app, and press Regenerate again. The dialog Regenerate recovery codes then shows ten new codes to save as in Step 3, and the old ones stop working. A recovery code cannot be used for this; it needs a current app code.

Get it right

Keep the recovery codes where a lost or wiped phone cannot take them with the app.

Recommended

The downloaded text file in a password manager, or printed and kept with your other important documents.

Less effective

A note on the same phone that runs the authenticator app.

Worked example

Sara opens Login and security, presses Enable, scans the QR code with her authenticator app, and sees a code such as 482 913 under EchoNova with her email. She types 482913 and presses Enable. The dialog shows ten recovery codes, each laid out like 3f2a-9b1c-4d5e-6f70-8a91-b2c3-d4e5-f607; she presses Download, saves the file into her password manager, ticks I saved these codes somewhere safe, and presses Done. The next morning she signs in with her password, the Two-factor authentication page appears, she types the six digits from her app, presses Verify, and lands on Home.

What happens next

Every sign-in to this account, by any method, now ends on the Two-factor authentication page until you turn two-factor off. Sessions already open in other browsers stay open until you turn two-factor off. The Two-factor authentication card on Settings shows On and offers Disable.

An account that has two-factor turned on but no authenticator app registered with it is asked to set one up at its next sign-in. The page Set up two-factor authentication says Your account requires an authenticator app. Scan the QR code below to continue. Scan the code, enter the 6-digit code, press Confirm, save the recovery codes as in Step 3, and press Done; the portal then opens as usual.

Limits

Limit	Value	Applies to
Authenticator code	6 digits; a new one every 30 seconds; one step of drift either way is accepted	Enable, sign-in check, disable
Time to confirm the first code	10 minutes from pressing Enable	Enabling and the set-up-at-sign-in page
Time to pass the sign-in check	5 minutes from the password or provider sign-in being accepted	Two-factor authentication page
Recovery codes	Ten codes, each 32 characters in eight groups of four; dashes, spaces and letter case are ignored when you enter one	Sign-in check and Disable
Recovery code life	Each code works once; Regenerate or turning two-factor off and on replaces all ten	Sign-in check and Disable
Wrong codes	5 wrong codes in 5 minutes pause further tries for a while	Sign-in check, Disable, Regenerate

Troubleshooting

That code is not correct. Check it and try again.

While enabling, the 6-digit code does not match the entry you just scanned: wait for the app to show a new code and enter that one. If the app holds an older EchoNova entry from an earlier enrolment, delete it and scan the current QR code. At sign-in, when disabling or when regenerating, neither a current app code nor an unused recovery code matched: check that the app's entry is the one for this account, wait for the next code, or switch to Lost your device? Use a recovery code and enter an unused code.

Too many attempts. Wait a little, then try again.

Five wrong codes in five minutes pause further tries. Wait a few minutes, then enter a current code.

Something went wrong. Please try again.

Two causes show this text. While enabling, more than 10 minutes passed between pressing Enable and confirming the code: close the dialog and press Enable again, and scan the new QR code, not the old one. On the Two-factor authentication page, more than 5 minutes passed since the password or provider sign-in was accepted: press Back to sign in and sign in again.

The page was reloaded or opened directly, so the sign-in it belonged to is gone. Sign in again and complete the check without leaving the page.

Could not start setup.

The dialog could not fetch a QR code. Close it and try Enable again.

FAQ

Yes. The check runs after the provider returns you to the portal, exactly as it does after a password.

How many recovery codes do I get?

Ten, shown once when you turn two-factor on. Each works one time. To get ten new ones, press Regenerate on the Recovery codes row; the old ones stop working.

I lost my phone and my recovery codes. What now?

The sign-in check accepts only a code from the app or an unused recovery code, so keep the codes somewhere you can reach without the phone. A browser that is still signed in does not help: Disable and Regenerate on Login and security ask for an app code (and Disable also accepts a recovery code).

Do I need my password to turn two-factor off?

No. Disable asks for a current app code or a recovery code, which is why Google and Microsoft accounts can use it too.

Does turning two-factor on or off sign out my other devices?

Turning it on does not: sessions that are already open stay open, and the check applies to new sign-ins. Turning it off ends your sessions on other devices.

Sign-in methods: the sign-in the check is added to
Account and profile: the rest of the Login and security tab
What is EchoNova: the portal the account opens