Two-Factor Authentication
Protect your sign-in with a code from an authenticator app, and what to do if you lose your phone.
Two-Factor Authentication
Two-factor authentication adds a second step to signing in. After your password, Mailnaptic asks for a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot sign in without your phone. It is optional and set up per person, not per organization.
Turning it on
- Install an authenticator app if you do not have one, for example Google Authenticator, Microsoft Authenticator, 1Password or Authy.
- Open Security from the user menu in the top-right corner (or Settings and then Manage two-factor authentication). The page is at /settings/security.
- Click Set up authenticator app and enter your current password.
- Scan the QR code with your app. If you cannot scan it, choose “Enter a setup key” in the app and type the key shown below the code.
- Enter the 6-digit code your app shows and click Turn on.
- Save your recovery codes: download or copy them, tick I saved these recovery codes somewhere safe, and click Done.
You stay signed in on your other devices when you turn it on, and you get an email telling you it is on.
Signing in
Enter your email and password as usual. The next screen asks for the code from your app. Type the 6 digits and you are signed in. Each code can be used once, so if you just used a code, wait for the app to show the next one. The app changes the code every 30 seconds. If your codes are never accepted, check that the time on your phone is set automatically.
You get a few attempts. After five wrong codes the account is locked for 15 minutes.
Recovery codes
You get 10 recovery codes. Each one works once, in place of the app code, if you lose your phone or cannot open the app. On the sign-in screen click Use a recovery code and enter one, for example ABCDE-FGHJK. Mailnaptic emails you when a recovery code is used and tells you how many are left.
The codes are shown only once, when you create them. They are stored in a form that cannot be read back, so nobody at Mailnaptic can show them to you. Keep them in a password manager or print them. To get a fresh set, open Security, click Create new recovery codes and confirm with your password and a code. The old codes stop working.
Turning it off
Open Security, click Turn off, and enter your password and a code (an app code or a recovery code). Turning it off signs you out of all your other devices, keeps this one signed in, and sends you an email.
Other things to know
- Forgot your password? Resetting it does not turn off two-factor authentication. You still need a code the next time you sign in.
- Changing your email in Settings asks for a current code when two-factor authentication is on.
- API keys are not affected. They never need a code, and they cannot change this setting.
- Turning it on or off, using a recovery code and failed codes are recorded in the audit log on plans that include it.
Lost your phone and your recovery codes?
Contact support from the email address on your account. For your protection we verify your identity before we turn two-factor authentication off for you.
Tip: When you get a new phone, set up the authenticator app on it before you wipe the old one, or create new recovery codes first so you are never locked out.