> For the full page index, fetch https://echonova.ai/llms.txt

# Two-factor authentication

Turn on codes from an authenticator app for every sign-in, save your recovery codes, pass the check at sign-in, and turn it off again.

Two-factor authentication adds a second check to every sign-in: after your
password, or after Google or Microsoft returns you to the portal, you enter the
6-digit code your authenticator app shows for EchoNova. Turn it on from
Settings in a few minutes. When you finish this page you will have it on, you
will have your ten recovery codes saved somewhere safe, and you will know how
to sign in with either the app or one of those codes.

## What you need

- An account you are signed in to. Every sign-in method can turn this on:
  email and password, Google or Microsoft.
- An authenticator app on your phone or computer that scans a QR code and
  shows time-based codes, such as Google Authenticator or Microsoft
  Authenticator.
- A place to keep the recovery codes that is not the same device as the app.

## Steps

### Step 1: Open Login and security

Open the user menu, choose **Account settings**, and select the
**Login and security** tab. The **Two-factor authentication** card reads
**Add a code from an authenticator app on top of your password.** with a chip
that says **Off** or **On**.

### Step 2: Scan the code and confirm

1. Press **Enable**. The dialog **Enable two-factor authentication** shows
   **Setting up two-factor authentication…** for a moment, then changes to
   **Scan and confirm**.
2. In your authenticator app, add an account by scanning the QR code shown.
   If you cannot scan, the box **Can't scan? Enter this setup key manually**
   holds the key; press **Copy** and paste it into the app. The entry appears
   in the app as **EchoNova** with your email address.
3. Type the 6-digit code the app now shows into the field under the key.
4. Press **Enable**. The dialog moves to **Save your recovery codes**.

<!-- screenshot: two-factor-authentication/1 the Scan and confirm step with the QR code and setup key masked -->

You have 10 minutes from pressing **Enable** to confirm the first code. After
that, the dialog answers **Setup session expired; please restart enrollment**;
close it and press **Enable** again to get a new QR code.

### Step 3: Save the recovery codes

The **Save your recovery codes** step shows ten codes, each 32 characters in
eight groups of four, and this notice: **Store these codes somewhere safe. They
are shown only once. Each code works one time if you lose access to your
authenticator app. Anyone with a code can pass two-factor, so keep them
private.**

Press **Copy all** to put them on the clipboard, or **Download** to save them
as a text file. Tick **I saved these codes somewhere safe**, then press
**Done**; **Done** stays disabled until the box is ticked. A toast confirms
**Two-factor authentication enabled**, and the card's chip reads **On**.

> [!WARNING]
> The recovery codes are the only way through the sign-in check without your
> authenticator app. If you lose the device and have no unused code, you
> cannot complete a sign-in. Copy or download the codes before you press
> **Done**; they are never shown again. Each one works a single time, so
> treat them like passwords: keep them apart from the phone that holds the
> app, and if anyone else may have seen them, press **Regenerate** on the
> **Recovery codes** row to replace all ten.

### Step 4: Pass the check at sign-in

From now on, each sign-in ends on the **Two-factor authentication** page:
**Enter the code from your authenticator app.**

1. Open the app and read the current 6-digit code for **EchoNova**.
2. Type it into **Authentication code** and press **Verify**. The portal opens
   on **Home**, or on the page you were heading to.

The app's code changes every 30 seconds; the code from the step just before or
just after is also accepted, so a phone whose clock is a few seconds off is
fine.

Without the app, select **Lost your device? Use a recovery code**. The page
changes to **Enter your recovery code.** with a **Recovery code** field. Typing
a letter, a dash or a seventh character into **Authentication code** switches
to this mode on its own. Enter one unused code with or without its dashes, in
either case, and press **Verify**. That code is then spent. **Use your authenticator app instead** switches
back.

Complete the check within 5 minutes of your password or provider sign-in being
accepted. After that the code is refused; press **Back to sign in** and sign in
again.

### Step 5: Turn it off, or start over with a new app

Two-factor is turned off from the same card. Press **Disable**; the dialog
**Disable two-factor authentication** asks you to **Enter your current
authentication code or a recovery code to turn off two-factor
authentication.** Enter either and press **Disable**. A toast confirms
**Two-factor authentication disabled**, the chip reads **Off**, and the
recovery codes stop working. Your sign-in sessions on other devices end; this
browser stays signed in.

To move to a new phone or a new app, turn two-factor off and then on again.
The card offers **Disable** while the chip reads **On**; once it reads
**Off**, press **Enable** and scan with the new app. The new enrolment issues
a new QR code and ten new recovery codes.

### Step 6: Keep track of your recovery codes

While two-factor is on, the **Login and security** tab shows a **Recovery
codes** row with how many are left, such as **8 recovery codes left**. When one
or none is left it adds **You have 1 recovery code left. Regenerate to get 10
new ones.** Press **Regenerate**, enter the 6-digit code from your authenticator
app, and press **Regenerate** again. The dialog **Regenerate recovery codes**
then shows ten new codes to save as in Step 3, and the old ones **stop working**.
A recovery code cannot be used for this; it needs a current app code.

## Get it right

Keep the recovery codes where a lost or wiped phone cannot take them with the app.

**Recommended**

- The downloaded text file in a password manager, or printed and kept with
  your other important documents.

**Less effective**

- A note on the same phone that runs the authenticator app.

## Worked example

Sara opens **Login and security**, presses **Enable**, scans the QR code with
her authenticator app, and sees a code such as `482 913` under **EchoNova**
with her email. She types `482913` and presses **Enable**. The dialog shows
ten recovery codes, each laid out like `3f2a-9b1c-4d5e-6f70-8a91-b2c3-d4e5-f607`;
she presses **Download**, saves the file into her password manager, ticks
**I saved these codes somewhere safe**, and presses **Done**. The next morning she signs in with her password, the
**Two-factor authentication** page appears, she types the six digits from her
app, presses **Verify**, and lands on **Home**.

## What happens next

Every sign-in to this account, by any method, now ends on the
**Two-factor authentication** page until you turn two-factor off. Sessions
already open in other browsers stay open until you turn two-factor off. The **Two-factor authentication**
card on Settings shows **On** and offers **Disable**.

An account that has two-factor turned on but no authenticator app registered
with it is asked to set one up at its next sign-in. The page
**Set up two-factor authentication** says **Your account requires an
authenticator app. Scan the QR code below to continue.** Scan the code, enter
the 6-digit code, press **Confirm**, save the recovery codes as in
[Step 3](/docs/account/two-factor-authentication#step-3-save-the-recovery-codes),
and press **Done**; the portal then opens as usual.

## Limits

| Limit                          | Value                                                                                                                | Applies to                                 |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| Authenticator code             | 6 digits; a new one every 30 seconds; one step of drift either way is accepted                                       | Enable, sign-in check, disable             |
| Time to confirm the first code | 10 minutes from pressing **Enable**                                                                                  | Enabling and the set-up-at-sign-in page    |
| Time to pass the sign-in check | 5 minutes from the password or provider sign-in being accepted                                                       | **Two-factor authentication** page         |
| Recovery codes                 | Ten codes, each 32 characters in eight groups of four; dashes, spaces and letter case are ignored when you enter one | Sign-in check and **Disable**              |
| Recovery code life             | Each code works once; **Regenerate** or turning two-factor off and on replaces all ten                               | Sign-in check and **Disable**              |
| Wrong codes                    | 5 wrong codes in 5 minutes pause further tries for a while                                                           | Sign-in check, **Disable**, **Regenerate** |

## Troubleshooting

### That code is not correct. Check it and try again.

While enabling, the 6-digit code does not match the entry you just scanned:
wait for the app to show a new code and enter that one. If the app holds an
older **EchoNova** entry from an earlier enrolment, delete it and scan the
current QR code. At sign-in, when disabling or when regenerating, neither a
current app code nor an unused recovery code matched: check that the app's
entry is the one for this account, wait for the next code, or switch to
**Lost your device? Use a recovery code** and enter an unused code.

### Too many attempts. Wait a little, then try again.

Five wrong codes in five minutes pause further tries. Wait a few minutes, then
enter a current code.

### Something went wrong. Please try again.

Two causes show this text. While enabling, more than 10 minutes passed between
pressing **Enable** and confirming the code: close the dialog and press
**Enable** again, and scan the new QR code, not the old one. On the
**Two-factor authentication** page, more than 5 minutes passed since the
password or provider sign-in was accepted: press **Back to sign in** and sign
in again.

### The Two-factor authentication page sent me back to the sign-in page

The page was reloaded or opened directly, so the sign-in it belonged to is
gone. Sign in again and complete the check without leaving the page.

### Could not start setup.

The dialog could not fetch a QR code. Close it and try **Enable** again.

## FAQ

### Does two-factor apply when I sign in with Google or Microsoft?

Yes. The check runs after the provider returns you to the portal, exactly as
it does after a password.

### How many recovery codes do I get?

Ten, shown once when you turn two-factor on. Each works one time. To get ten
new ones, press **Regenerate** on the **Recovery codes** row; the old ones stop
working.

### I lost my phone and my recovery codes. What now?

The sign-in check accepts only a code from the app or an unused recovery code,
so keep the codes somewhere you can reach without the phone. A browser that is
still signed in does not help: **Disable** and **Regenerate** on
**Login and security** ask for an app code (and **Disable** also accepts a
recovery code).

### Do I need my password to turn two-factor off?

No. **Disable** asks for a current app code or a recovery code, which is why
Google and Microsoft accounts can use it too.

### Does turning two-factor on or off sign out my other devices?

Turning it on does not: sessions that are already open stay open, and the
check applies to new sign-ins. Turning it off ends your sessions on other
devices.

## Related

- [Sign-in methods](/docs/account/sign-in-methods): the sign-in the check is added to
- [Account and profile](/docs/account/account-and-profile): the rest of the **Login and security** tab
- [What is EchoNova](/docs/get-started/what-is-echonova): the portal the account opens