Two-factor authentication

Two-factor authentication asks for a code from your phone after your password, so someone who learns your password still can’t sign in. Luzbase uses an authenticator app for the codes, with recovery codes as a backup.

Before you start

• Verify your email address first. Your email is how you get back in if you lose your phone, so Luzbase asks you to confirm it before you turn on two-factor. See Profile and email address.
• Install an authenticator app on your phone, such as Microsoft Authenticator, Google Authenticator or 1Password. Any app that supports standard 6-digit time-based codes works.

Two-factor is optional for every account.

Turn on two-factor authentication

1. Open your avatar menu and click Security.
2. Under Two-factor authentication, find Authenticator app and click Set up.
3. Scan this QR code with your authenticator app. If you can’t scan it, click Can’t scan it? Enter this key instead and type or copy the key into the app.
4. Click I’ve scanned it.
5. Under Enter the code from your app, type the 6-digit code your app shows and click Verify.
6. You see Your account is protected. Save your recovery codes now: click Copy all or Download, and store them somewhere safe, such as a password manager.
7. Tick I’ve saved my recovery codes and click Done.

The Authenticator app row now shows an On badge.

Save your recovery codes

The recovery codes are shown only once. If you close the dialog without saving them, Luzbase asks Close without saving your codes? You can generate a new set later from Security, which asks for a current code.

Sign in with two-factor

After your email and password (or Google or GitHub), Luzbase shows Confirm it’s you.

1. Open your authenticator app and find the Luzbase code. It changes every 30 seconds.
2. Enter it and click Verify and sign in.

You have 5 minutes and 5 attempts to enter a code. After that, sign in again.

Use a recovery code

If you don’t have your phone:

1. On Confirm it’s you, click Use a recovery code (after “Lost access to your authenticator?”).
2. Enter one of your saved recovery codes and click Verify and sign in.

You get 10 recovery codes, and each one works once. Luzbase emails you when a recovery code is used.

Check or replace your recovery codes

Under Two-factor authentication on Security, the Recovery codes card shows how many codes you have left, for example “7 of 10 codes left”. When you have two or fewer left, it warns you.

To get a fresh set:

1. Click Regenerate (or Generate new set when you’re running low).
2. In Generate new recovery codes?, enter your Password (if your account has one) and a current code from your authenticator app or a recovery code.
3. Click Generate codes.
4. Save the new codes from Your new recovery codes.

Your old codes stop working at once.

Turn off two-factor authentication

1. On Security, click Turn off next to Authenticator app.
2. In Turn off the authenticator app?, confirm with your Password or with a Two-factor code.
3. Click Turn off.

Luzbase emails you when two-factor is turned on or off.

Other actions that ask for a code

While two-factor is on, Luzbase also asks for a code when you:

• change your email address
• delete your account

If you lose your phone and your recovery codes

You can’t turn off two-factor yourself without a code. Contact support from the email address on your account and explain what happened.

Related

• Change or reset your password
• Sessions and signing out
• Sign-in methods