Two-factor authentication

What it does

Two-factor authentication adds a second step to signing in. After your password, or after using an emailed sign-in link, Formwork asks for a six-digit code from an app on your phone. A stolen or guessed password is then not enough to get into your account.

Any authenticator app that supports the standard time-based codes will work, such as those from Google, Microsoft, or a password manager. The codes are six digits and change every 30 seconds.

Turn it on

1. Open Account and security from the account menu and go to Two-factor authentication.
2. Select Set up two-factor. If your account has a password, enter it first.
3. Scan the QR code with your app. If you cannot scan it, enter the key shown below the code by hand. It is displayed in groups of four characters.
4. Enter the six-digit code your app now shows, and select Turn on.

If the code is wrong the page says "That code is not right. Check the app and try again." Ten wrong attempts in ten minutes pause setup for a while. Cancel abandons the setup.

Recovery codes

When it turns on, Formwork shows ten recovery codes, written like k4m7p-x9q2w. Each works once, in place of an app code, if you lose your phone. Copy all copies them together.

They are shown only once, and only a scrambled version is stored, so Formwork cannot show them again. Keep them somewhere separate from your phone, such as a password manager or a printed page in a safe place. The Account page says how many are left, for example "7 of 10 recovery codes left."

Signing in

After your password (or emailed link), the Enter your code page asks for the six-digit code. You can also type a recovery code there. The app code is accepted for the current 30-second window plus one either side, so a clock that is slightly off still works.

After six wrong tries in ten minutes you are asked to sign in again in a few minutes.

Replacing recovery codes

If you have used several, or think someone saw them, enter your current password under Get new recovery codes and select New codes. The old codes stop working immediately. You can also confirm with a current app code if you have no password.

Turning it off

Under Turn off two-factor, enter your password and select Turn off. Your secret and recovery codes are deleted. Turning it off, and turning it on, both trigger a security notice email to the address on your account.

If you lose your phone and your recovery codes

There is no self-service way back in, because that would defeat the point. If you can sign in on another device that is already signed in, turn two-factor off from its Account page. Otherwise, contact whoever runs your Formwork installation.

Accounts without a password

An account made with KingsChat starts with no password. You can still turn on two-factor authentication. Setting it up needs no password, and you confirm with a code from your app. Replacing recovery codes or turning it off later asks for a code instead of a password. See Signing in with KingsChat.

Related

• Ways to sign in
• Download or delete your account data, which also asks you to confirm it is you.