Two-Factor Authentication (2FA)

Two-Factor Authentication (2FA)

Two-factor authentication adds a second step to sign-in: after your password, you enter a rolling 6-digit code from an authenticator app. Even if your password is stolen, no one gets in without that code. It's strongly recommended for every account.

Where it lives

Go to Dashboard → Settings, then click Security & 2FA (next to Change Password). On the Security page you'll find two cards: Two-factor authentication and your active sessions.

What's supported

HandyBook uses authenticator app (TOTP) codes. Any TOTP app works:

• Google Authenticator
• 1Password (built-in)
• Authy
• Microsoft Authenticator

(There's no SMS or hardware-key option — TOTP apps are free, work offline, and are more secure than SMS.)

Turning on 2FA

1. On the Security page, in the Two-factor authentication card, click Add factor.
2. The Set up two-factor authentication dialog opens and generates a secret.
3. Scan the QR code with your authenticator app — or tap the key underneath to copy it and enter it manually.
4. Type the 6-digit code your app shows.
5. Click Enable.

The factor now appears in the list as verified, with the date you added it. From the next sign-in on, you'll be asked for a code.

Signing in with 2FA

1. Enter your email and password.
2. When prompted, open your authenticator app.
3. Type the current 6-digit code.
4. You're in.

Managing factors

• You can add more than one factor (e.g. apps on two phones) with Add factor.
• To remove one, click the trash icon next to it and confirm. Removing your only factor returns the account to password-only — you can re-enroll any time.

Active sessions

The sessions card below 2FA lists everywhere you're signed in, with your current device marked. You can:

• Revoke an individual session (signs that device out), or
• Revoke all other sessions to sign out everywhere except where you are.

Use this if you lose a device or suspect someone else has access.

FAQ

Do I have to use 2FA? It's not forced, but it's strongly recommended — especially for owners, who control billing and company data.

My code isn't accepted. TOTP codes are time-based. Make sure your phone's clock is set to automatic, then try the next fresh code.

I lost my phone — how do I get in? If you have a second factor enrolled on another device, use that. Otherwise contact support for identity-verified account recovery.

Can I rename a factor? The friendly name is set when you enroll (it includes the date). Renaming later isn't available in-app.

Does 2FA apply on every device? Yes — 2FA is tied to your account, so any new sign-in asks for a code.