---
title: "Two-step verification"
canonical: https://syncek.com/docs/account/two-step-verification
locale: en
author: "Syncek"
---

# Two-step verification

Syncek supports two-step verification, also called two-factor authentication or
2FA, on every account. You turn it on in **Settings, then Personal, then
Security**: scan a QR code with an authenticator app, type the 6-digit code it
shows, and save ten single-use backup codes. From then on, signing in with a
password, Google or GitHub asks for a code as a second step. Admins and the Owner
can also require it for everyone in the organization.

## Turning it on

1. In **Settings, then Personal, then Security**, under **Two-factor
   authentication**, click **Set up**.
2. If your account has a password, type it in **Confirm your password**. Click
   **Continue**.
3. Scan the QR code with your authenticator app. If you can't, type in the key
   under **Can't scan it? Enter this key:** instead.
4. Type the **6-digit code** the app shows and click **Turn on**.
5. Save the backup codes with **Copy** or **Download**, tick **I've saved these
   codes somewhere safe** and click **Done**. They are not shown again.

Two-step verification stays off until step 4 succeeds. Setting it up, turning it
off and generating new backup codes need a sign-in from the last 15 minutes. If
yours is older, Syncek asks you to sign in again first.

## Signing in

After your password, Google or GitHub, the **Two-step verification** page asks for
the **6-digit code** from your app. Click **Verify**. Two links offer the other
ways: **Email me a code instead**, which sends one valid for 3 minutes, and **Use
a backup code instead**. Each backup code works once.

**Trust this device for 30 days** is ticked by default, so that browser skips the
code when you sign in on it again.

## Trusted devices and new backup codes

**Trusted devices**, in **Settings, then Personal, then Devices**, counts the
devices that skip the code. **Revoke all** makes each of them ask again at its
next sign-in, and so does **Sign out** on the same page.

**Generate new codes**, under **Backup codes** on the **Security** page, gives you
a new set. The old codes stop working straight away.

## If you lose your phone

Sign in with a backup code or an emailed code. On the **Security** page, click
**Turn off**, then **Set up** again with the new phone. Your old backup codes stop
working when you turn it off. If you cannot sign in at all, see the last section.

## Requiring it for everyone

**Settings, then Organization, then Security** has the **Two-factor for everyone**
switch. Only Admins and the Owner can change it, and to switch it on they need
two-step verification on their own account. Syncek first says how many people
have not turned it on yet, and **Require two-factor** confirms. From their next
visit, anyone without it sees **Two-factor authentication required** and cannot
use the organization until they set it up.

Admins and the Owner also see **Two-factor activity** on that page, newest first.
It lists events such as turning it on or off, wrong codes, used backup codes,
resets and changes to the requirement.

## Resetting it for someone else

In **Settings, then Organization, then Users and teams**, open the menu at the end
of the person's row, choose **Reset two-factor** and confirm. Their authenticator
app and backup codes stop working, the devices they trusted are forgotten, they
are signed out everywhere, and an email asks them to set it up again.

- **Reset two-factor** appears only for people who have two-step verification on.
- The Owner can reset it for Admins, Members and Guests, and an Admin for Members
  and Guests. Nobody can reset the Owner's this way, or their own.
- It needs a sign-in from the last 15 minutes.