# Turn on two-factor authentication

Two-factor authentication adds a 6-digit code from an authenticator app to your password at every sign-in. It belongs to your account, so it applies in every workspace you are a member of.

## Before you begin

- An authenticator app that makes time-based 6-digit codes, such as Google Authenticator, 1Password or Authy.
- Your Faustine password. Every change to two-factor authentication asks for it.

## Turn on two-factor authentication

To turn it on:

1. In the portal, select your name in the sidebar and then [**Profile**](https://auth.faustine.ai/go?to=%2Fprofile).
2. In **Security**, select **Enable** in the **Two-factor authentication** row.
3. In **Enable two-factor authentication**, enter your **Current password** and select **Continue**.
4. In **Scan with your authenticator app**, add an account in your app and scan the QR code. If you cannot scan it, select **Can't scan it? Enter the key instead** and type the key into the app.
5. Select **Next**.
6. In **Enter the code the app shows**, enter the 6-digit code listed under **Faustine** in your app. The code changes every 30 seconds.
7. Select **Turn on**.
8. Save the 8 recovery codes with **Download .txt** or **Copy all**.
9. Select **I saved my recovery codes somewhere safe.** and then **Done**.

> **Warning:** The recovery codes are shown once. Each one signs you in a single time if you lose your phone. Store them where you keep your passwords.

The row shows an **On** badge, the date it was enabled and the number of recovery codes left. Other members see a **2FA** badge next to your name in **Team**.

## Generate new recovery codes

Generate a new set when few codes are left or when the saved ones may have leaked.

1. In the **Two-factor authentication** row, select **New recovery codes**.
2. Enter your **Current password** and select **Generate new codes**.
3. Save the new codes and select **Done**.

You get 8 new codes. Every code you saved before stops working.

## Turn off two-factor authentication

1. In the **Two-factor authentication** row, select **Turn off**.
2. Enter your **Current password** and select **Turn off**.

Your password alone signs you in again, in every workspace, and your recovery codes stop working.

## When a workspace requires it

A workspace can require two-factor authentication for its members. The requirement is set for the workspace. To change it, contact Faustine.

- If you have not turned it on, the row says **Required by** and the workspace's name, and you are asked to set it up at your next sign-in.
- If it is on, the row shows **Policy** with the same text, and **Turn off** is not offered.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| **That code doesn't match.** | The code expired, or the app has an entry from an earlier attempt. | Enter the newest code. If it still fails, select **Back to the QR code** and scan it again. |
| **That QR code is too old.** | The setup was left open for more than 15 minutes. | Scan the new QR code the dialog shows and enter its code. |
| **Current password is incorrect** | The password does not match. | Enter your account's password. |
| **QR unavailable — enter the key instead** | The browser could not draw the QR code. | Select **Can't scan it? Enter the key instead**. |

## Next steps

- [Change your profile and password](https://docs.faustine.ai/workspace/profile/): the other settings of your account.
- [Remove a member or revoke an invitation](https://docs.faustine.ai/workspace/manage-members/): see which members have two-factor authentication on.
- [Work in more than one workspace](https://docs.faustine.ai/workspace/workspaces/): the second factor is shared by all of them.