Two-factor authentication
Turn on an authenticator app as a second sign-in step, keep your 10 backup codes safe, and what to do before you change phones.
On this page
Two-factor authentication means your password alone isn’t enough to sign in. It’s optional, free on every plan, and we recommend it.
Today, PIToolkit supports authenticator apps (such as Google Authenticator, Microsoft Authenticator, Authy or 1Password), with backup codes as a fallback. Security keys and other methods are planned and not available yet.
Turning it on
- Go to Settings, section Account & security, Two-factor authentication.
- Choose Turn on two-factor authentication and enter your current password.
- Scan the QR code with your authenticator app. If you can’t scan it, type the setup key shown under “Can’t scan it?” into your app instead.
- Enter the 6-digit code your app shows.
- Save your backup codes, then choose I’ve saved these.
Turning it on signs out every other device and browser you were signed in on, so anyone who was already in has to get past the new step. The tab you turned it on from stays signed in.
Backup codes
You get 10 backup codes. Each one works once, in place of an authenticator code. Keep them somewhere safe and separate from your phone, such as with your printed recovery key.
When you sign in with a backup code, PIToolkit tells you it won’t work again and how many you have left. When you’ve used the last one, it says so: generate a new set from Settings. To get a fresh set, choose Manage, then Generate new backup codes; you’ll confirm your password and an authenticator or backup code. Your old codes stop working straight away, and we email you “Your PIToolkit backup codes were replaced”. That email can’t be switched off, so if you didn’t ask for new codes, change your password.
Changing your password also gives you a new set of backup codes.
Signing in
After your password, enter the current 6-digit code from your app. Codes change every 30 seconds. After five wrong codes, that sign-in attempt stops and you start again with your password.
Before you change or reset your phone
To turn two-factor authentication off, you need your password and a current code from your authenticator app; a backup code isn’t accepted. And you can’t set up a new app while two-factor authentication is on.
So before you wipe, replace or reset the phone your authenticator app is on, do one of these:
- Move the account to your new phone using your authenticator app’s own transfer or backup feature, or
- Turn two-factor authentication off (Manage, then Turn off) using the old phone, then turn it on again with the new one.
If the phone is already gone, you can keep signing in with backup codes, and generate a new set when you’re running low. See Authenticator codes not working.
If you lose your app and every backup code
Your recovery key doesn’t get you past two-factor authentication, and PIToolkit staff can’t remove or reset your second factor. If you lose your authenticator app and all your backup codes, you can’t sign in to this account. That’s the other side of making sure nobody else can either. Keep your backup codes safe.