# Two-step verification (Help)

URL: https://qrdx.dev/docs/help/privacy-and-security/two-step-verification
Source: https://github.com/bucharitesh/qrdx/blob/main/apps/docs/content/docs/help/privacy-and-security/two-step-verification.mdx

Add a second step to every sign-in with a passkey or an authenticator app, keep backup codes, and get back in if you lose your phone.

Two-step verification (also called 2FA) adds a second step to signing in. After you sign in with an email code, Google or GitHub (or your workspace's single sign-on), QRdx asks for your passkey or a 6-digit code from an authenticator app. Someone who gets into your email or your Google account still can't get into QRdx without it.

A [passkey](https://qrdx.dev/docs/help/privacy-and-security/passkeys) checks it's you with your fingerprint, face, screen lock or a security key. It only works on QRdx's own site, so a look-alike site can't collect it.

An authenticator app works too: any app that shows 6-digit codes that change every 30 seconds, including the one-time code feature of most password managers. QRdx doesn't send second-step codes by email or text message.

You can set up both, and use whichever is to hand when you sign in.

## Turn it on [#turn-it-on]

1. Go to **Settings** → **Profile & security**.
2. Under **Two-step verification**, click **Turn on**, and [confirm it's you](#confirm-its-you).
3. Set up your second step: pick **Passkey** or **Authenticator app**, as described below.
4. Save your 10 backup codes. Copy them or download them as a text file, and keep them somewhere safe, such as a password manager. QRdx shows them only once. Tick **I've saved my backup codes** and click **Done**.

For a passkey, keep the suggested name (your browser and system, like "Chrome on macOS") or type your own, click **Continue**, and let your browser save the passkey.

For an authenticator app, scan the QR code with the app, or type the key shown under it. Enter the 6-digit code the app shows and click **Verify**.

Two-step verification is now on, and every other browser or device signed in to your account is signed out. Each one has to sign in again, now with the second step. The browser you turned it on in stays signed in. To add the other method later, use the same section. You keep the backup codes you already have, and nobody is signed out.

If you added a passkey before two-step verification could use one, Settings says **Your passkey is ready to be your second step**. Click **Turn on**, confirm it's you, check it's you with that passkey, and save your backup codes. This signs out your other devices too.

We email your account's address whenever two-step verification is turned on or off, a method is added or removed, new backup codes are made, or a backup code is used. We also email it when support is asked to turn two-step verification off for you.

## Sign in with it [#sign-in-with-it]

Sign in the way you always do. QRdx then asks for the second step.

If you have a passkey, your browser's passkey prompt opens on its own. Some browsers only open it after a click: then click **Continue with passkey**. If you closed the prompt or it timed out, try again, or pick another method.

Below the step, **Use an authenticator code** and **Use a backup code** switch to the other methods you have. QRdx remembers which one you used last in this browser and starts with it next time.

Authenticator codes change every 30 seconds, so if one is rejected, wait for the next.

Each sign-in step allows 5 wrong codes, and a passkey that fails to verify counts as one. After that, start the sign-in again. After 10 wrong codes in a row, QRdx stops accepting codes for your account for 15 minutes.

The step expires after 10 minutes. If it does, sign in again.

## Backup codes [#backup-codes]

A backup code works instead of your second step, for when you don't have your phone or your passkey. On the second step, click **Use a backup code** and enter one. Codes look like `ABCDE-FGH23`: capital letters and the digits 2 to 9, with no 0, O, 1 or I to mix up. You can type them in lower case, and with or without the dash. Each code works once.

Each time a backup code is used, to sign in or to confirm it's you, we email your account's address with how many codes you have left. If it wasn't you, someone has your backup codes: contact support straight away.

Settings shows how many codes you have left. When you're down to 2 or fewer, make new ones: click **New codes** and confirm it's you. Your old codes stop working.

## Trusted devices [#trusted-devices]

On the second step, tick **Don't ask again on this device for 30 days** to skip it on that browser for 30 days. Only use it on a device that's yours. Turning two-step verification off forgets every trusted device.

## Which sign-ins ask for it [#which-sign-ins-ask-for-it]

All of them: email codes, Google and GitHub, and workspace single sign-on. That includes signing in again in a browser where you're already signed in.

Signing in with **Continue with passkey** is the exception. A passkey sign-in already uses two factors, the device and your fingerprint, face or screen lock, so QRdx doesn't ask for a second step. QRdx only accepts passkeys that check you that way.

## Change your methods [#change-your-methods]

In **Settings** → **Profile & security**, under **Two-step verification**, set up or remove the authenticator app, and add, rename or remove passkeys. Each change asks you to confirm it's you.

If you remove your last method, two-step verification turns off and your backup codes stop working. QRdx tells you before you confirm.

## Confirm it's you [#confirm-its-you]

Before a change to your account's security, QRdx asks you to confirm it's you, even though you're signed in. That covers:

- changing your email address;
- deleting your account;
- turning two-step verification on or off, and new backup codes;
- adding or removing the authenticator app, and adding, renaming or removing a passkey;
- linking or unlinking a Google or GitHub account;
- creating an API key, creating an OAuth app or making a new client secret for one;
- approving an app that asks to use your QRdx account, on the **Authorize** screen;
- adding a webhook endpoint, changing an endpoint's URL, and showing or rotating its signing secret;
- adding a Slack or Discord notification webhook, or connecting an integration that sends your scans or form answers to another tool;
- in a workspace: deleting it, changing someone's role, removing someone, inviting an admin by email or with a join link, and [requiring two-step verification](https://qrdx.dev/docs/help/teams/require-two-step-verification) or no longer requiring it.

So does creating, editing, verifying or deleting a workspace's single sign-on connection, or requiring single sign-on.

With two-step verification on, confirm with your passkey, a code from your authenticator app, or a backup code (which is then used up). QRdx doesn't offer an emailed code here, so getting into your email isn't enough to change your security.

With it off, confirm with any of these:

- a 6-digit code QRdx emails you;
- signing in again with a Google or GitHub account you've linked, or your workspace's single sign-on when it uses OIDC.

Your passkey works too, if you have one.

Signing in again takes you to that sign-in, where it asks you to pick or sign in to your account, and back to the same page. Your change isn't saved while you're away, so make it again when you're back. Use the account you linked: QRdx won't switch you to another account or create one.

So if you can't get into your email, you can still confirm another way. With none of them, see [Lost access to your email](https://qrdx.dev/docs/help/account-and-billing/sign-in#lost-access-to-your-email).

A confirmation lasts 10 minutes in that browser, so several changes in a row ask once.

Signing in also counts as confirming, for 10 minutes in that browser. With two-step verification on, that's only a sign-in where you answered the second step or used **Continue with passkey**, not one where a trusted device skipped it. Opening QRdx from your identity provider's app dashboard doesn't count either, unless you answered your second step.

Signing out your other devices never asks, so if someone else got into your account you can sign them out straight away.

## Turn it off [#turn-it-off]

Go to **Settings** → **Profile & security**, click **Turn off** under **Two-step verification**, and confirm it's you. Your backup codes, and your authenticator app setup if you have one, are deleted.

If a workspace you're in [requires two-step verification](https://qrdx.dev/docs/help/teams/require-two-step-verification), you can't open it again until you turn it back on.

## Lost your phone and your backup codes [#lost-your-phone-and-your-backup-codes]

If you still have a passkey, your authenticator app or a backup code, sign in with that and change your methods in Settings.

If you've lost every way to do the second step, email [support@qrdx.dev](mailto:support@qrdx.dev) from your account's email address and tell us what happened. Whoever writes to us might not be you, so once we've confirmed the request came from that address, support's turn-off waits 7 days:

- **We email that address the day it happens.** Until then nothing changes, and you stay signed in where you are.
- **If you didn't ask for it, stop it.** Sign in with your authenticator app or a backup code: that cancels it. Signing in with a passkey doesn't, because the reset is for a lost device and a passkey may be on it. You can also click **Cancel** under **Two-step verification** in **Settings** → **Profile & security** and [confirm it's you](#confirm-its-you), or reply to the email. We email you when it's cancelled.
- **On that day, two-step verification turns off.** Your authenticator app setup, backup codes and trusted devices are deleted, your passkeys stay, your account is signed out on every device, and we email you to say so. Then sign in as usual and turn it on again.