Set up and use 2FA as a user

Two-factor authentication (2FA) requires a second step after your password. Your site admin chooses which methods are allowed: an authenticator app (time-based codes) and/or email codes.

Admin setup: Enable 2FA in Security Ninja.

First-time setup

When 2FA is enabled (and your role requires it, or you opt in), you are prompted on login.

1. Enter your username and password as usual.
2. Authenticator app: Scan the QR code (or enter the secret manually) in an app such as Google Authenticator or Authy, then enter the 6-digit code to confirm.
3. Email codes: If the admin enabled email as a method, choose Email code, send a verification code to your inbox, and enter it on the login screen.

When both methods are enabled, you choose a preferred method at login. That preference is remembered.

4. After a successful code, you are logged in.

If the admin set a grace period (default 14 days), you may see a link to skip setup for that period. A grace of 0 means required-role users cannot skip.

Logging in after setup

1. Enter username and password.
2. Enter the code from your authenticator app, or the email code if that is your method.

3. When the code is valid, you see a confirmation and are signed in.

Backup codes

If your admin turned on backup codes, open your profile after 2FA is set up and create a set. Save the codes somewhere you can reach if you lose the phone. Each code works once, and the list is not shown again. On the next login, choose Use a backup code and enter one. A backup code does not remember the browser.

Creating a new set replaces the old codes. Changing your password, or an admin reset of 2FA, deletes them.

Remember this browser

If your admin set a number of days, the code screen has a checkbox. Tick it only on a browser you trust. That browser skips 2FA until the days run out, you change your password, or an admin resets 2FA. The checkbox does not apply when you use a backup code.

Resetting 2FA

Admins can reset 2FA from How to reset 2FA. If you are locked out, use the secret access URL or ask an admin to reset or bypass 2FA for your account.