# Turn on two-factor authentication

> Protect your account with a code from an authenticator app, and what to do if you lose your phone.

Go to **Settings → Your profile → Sign-in & 2FA** and click **Enable 2FA**. From then on, every sign-in asks for your password and a 6-digit code from an authenticator app.

Any TOTP app works: Google Authenticator, 1Password, Authy, Bitwarden and others. asktrix doesn't send codes by SMS or email.

## Set it up

1.  Click **Enable 2FA**.
2.  Open your authenticator app and add a new account.
3.  Scan the QR code. If you can't scan, use **Key for manual entry**.
4.  Enter the 6-digit code from the app and click **Verify**.
5.  Save your 10 recovery codes with **Copy** or **Download**, tick **I saved these codes somewhere safe** and click **Done**.

The recovery codes are shown only once. Keep them somewhere other than your phone, for example in your password manager.

If **Verify** says the code is invalid, check that your phone's clock is set automatically. The codes depend on the exact time.

## Sign in without your phone

On the code screen, click **Use a recovery code** and enter one of your saved codes. Each code works once. Under **Sign-in & 2FA** you can see how many are left.

When you're running low, click **Regenerate** and confirm with a code from your app. You get 10 new codes, and the old ones stop working.

## Lost your phone and your recovery codes

You can't reset 2FA yourself in that case, and neither can the owner of your workspace. Write to us from the email address of your account at [support@asktrix.org](mailto:support@asktrix.org). We check that the account is yours before we switch 2FA off, so this takes longer than a normal support request.

## Turn 2FA off

Under **Sign-in & 2FA**, click **Disable** and confirm with your password and a current code (or a recovery code).

If your workspace requires 2FA, you lose access to it until you set 2FA up again.

## Require 2FA for your whole team

Owners and admins can make 2FA mandatory under **Settings → Team → Members & teams → Security policy → Enforce two-factor authentication**.

Teammates who haven't set it up yet are sent to the setup on their next page load. They can't open the inbox or anything else in the workspace until they're done. Setup takes about a minute.

## Related

-   **Active sessions** on the same page lists every device you're signed in on. **Sign out all others** ends all of them except the one you're using.
-   Changing your password also signs out your other sessions.

---
Source: https://localhost:3100/help/en/two-factor-authentication