Two-factor authentication

Two-factor authentication (2FA) asks for a code from an authenticator app as well as the code we email you. Someone who gets into your inbox still can’t get into EmailFig. It’s set per person: turning it on protects your sign-in, not your teammates’.

Turn it on

1. Go to Settings → Security and, under Two-factor authentication, click Set up 2FA.
2. Confirm it’s you with the code we email you.
3. On the Scan the QR code screen, scan the code with your authenticator app (1Password, Google Authenticator, Authy or similar). If you can’t scan it, copy the secret shown underneath into the app.
4. Enter the 6-digit code your app shows and click Enable 2FA.
5. You’ll see Save your recovery codes. Click Copy all, store them somewhere safe, then click I’ve saved them.

From then on, after your emailed code you’ll see a Two-factor check screen asking for your authenticator code. Sensitive changes, like inviting a teammate, connecting Google or deleting the account, ask for it too.

Recovery codes

You get 10 recovery codes when you turn 2FA on. Each works once, anywhere EmailFig asks for your authenticator code (click Use a recovery code instead), so they get you in if you lose your phone. They’re shown only once, so save them straight away.

Settings → Security shows how many codes you have left, warns you when you’re running low, and we email you too. For a fresh set, click Regenerate recovery codes (Regenerate codes in the warning) and confirm it’s you. Your old codes stop working straight away, and the new 10 are shown once.

Turn it off

You need two codes to turn 2FA off.

1. Go to Settings → Security, find Disable 2FA, and enter a current code from your authenticator app, or click Use a recovery code instead.
2. Click Disable 2FA, then enter the code we email you.

2FA is now off, your recovery codes are cleared, and we send you a security alert email.

Moving to a new phone or app? Turn 2FA off first, then set it up again on the new device. You can’t set it up again while it’s still on.

Locked out with no recovery codes

If you’ve lost your authenticator and have no recovery codes left, nobody on your team can reset 2FA for you. Email contact@emailfig.com from your sign-in address and say you’re locked out. We’ll reset it and email you when 2FA is off. Then sign in with an emailed code and set it up again.

Related: Sign in without a password, Sign in with Google.