Two-Factor Sign-In, Remembered Devices and Backup Codes

Two-factor sign-in asks for a 6-digit code as well as your password. It is optional for advertisers and screen owners, and required for RedSquare staff. Everything here is at /settings/security (Settings → Sign-in & security).

Set it up (about a minute)

1. Open Sign-in & security and press Set up.
2. Get an authenticator app if you don't have one: Google Authenticator, Microsoft Authenticator, 1Password and Authy all work.
3. Scan the QR code with the app. If you can't scan it, press Can't scan it? and type the key in instead.
4. Type the 6-digit code the app shows. It turns on by itself on the sixth digit. Codes change every 30 seconds, so use the newest one.
5. Save your backup codes (below), then continue.

Remember this device for 30 days

At the code prompt, and right after you set up, there is a box: Remember this device for 30 days. It is ticked to start with — untick it on a computer that isn't yours.

• On a remembered device we don't sign you out when you're idle, and you keep your two-factor status for 30 days.
• After 30 days you are signed out once and sign in again with your password and a code. You can remember the device again then.
• On a device you didn't remember, you are signed out after 30 minutes idle, as before.
• Signing out on purpose ends it, and you tick the box again next time.
• A password alone never skips the code. Only a code makes a sign-in verified.

Settings → Sign-in & security lists your Remembered devices, with when each was remembered and last used. Press Forget to sign one out (it is asked for a code next time), or Forget all other devices.

Backup codes

When you set up, you get 10 backup codes. Each works once and we never show them again, so Copy or Download them and keep them in a password manager. Tick I've saved these codes to continue. If you already had an authenticator before backup codes existed, you'll see a Save your backup codes prompt after your next sign-in; Not now hides it, and you can make codes any time in Sign-in & security. Make new codes stops the old set working.

If you lose your phone

1. At the code prompt press Use a backup code instead and type one of your codes.
2. We remove your old authenticator and take you straight to setting up a new one. That new code is what signs you in.
3. The backup code is used up. Every other signed-in device and every remembered device is signed out, and we email you "Your two-factor sign-in was reset with a backup code". If it wasn't you, contact support.

Every try counts, correct ones too: 5 tries per 15 minutes (staff: 3 per hour). If you've run out of codes, contact support.

Email codes (screen owners and advertisers)

If you'd rather not use an app, choose Email me a code when you set up. We email a 6-digit code to your account address. It works for 10 minutes, once, and you get 5 tries per 15 minutes. Email is a weaker second step than an authenticator app, because a password reset goes to the same inbox, so the app is the safer choice. You can turn email codes off in Sign-in & security; devices you remembered with an email code are then forgotten.

Staff accounts

Admin, moderator and support accounts must use an authenticator app — email codes aren't offered — and staff pages need a code entered in the last 30 days. If a staff device is forgotten, or a backup code resets your two-factor, staff pages close until you enter a new code from your authenticator.

Native apps

The RedSquare phone apps are updated when you install a new version. Until then they don't have the remember box, backup codes or email codes, and still sign you out after 30 minutes idle.