Two-Step Verification
Protect password sign-in with a TOTP authenticator app and backup codes
Two-step verification asks for a six-digit code from an authenticator app whenever you sign in with your password. Any TOTP app works: Google Authenticator, 1Password, Authy, Apple Passwords.
Turning it on
In Settings → Security, under Two-step verification:
- Confirm your password. Enabling, and later disabling, always re-asks for it.
- Scan the QR code with your authenticator app and enter the code it shows.
- Save your backup codes. You get ten single-use codes for signing in if you lose the authenticator device. Store them somewhere safe; they are shown once at setup. At rest they are stored encrypted, never in plain text.
If you signed up with Google or GitHub and never set a password, you'll be asked to create one first. There is nothing for two-step verification to protect on an account with no password, so enrollment requires one, the same rule Cloudflare and others apply.
What it protects
The honest scoping, so you can plan around it:
- Protected: password sign-in. Every credential sign-in is challenged for a TOTP code or a backup code.
- Not challenged: Google and GitHub sign-in. Those already carry whatever second factor your Google or GitHub account enforces, so protect them there.
- SSO users: MFA is enforced by your identity provider on every sign-in; see Single sign-on. Zernio's two-step verification is not needed on top.
If password sign-in is your only method and you want the account fully behind a second factor, you're done. If you also use Google or GitHub sign-in on the same account, secure those accounts with their own 2FA.
Losing access
- Lost the authenticator, have backup codes: sign in with a backup code, then disable and re-enroll two-step verification with the new device.
- Lost both: contact support from your account email. Identity is verified manually before anything is reset.