How do I turn on two-factor authentication?

Two-factor authentication adds a second step to your sign-in: even if someone has your password, they can't get into your account without the rolling 6-digit code from your phone. We strongly recommend enabling it.

Turn it on

1. Sign in and go to Account → Security.
2. Click Set up two-factor authentication.
3. Scan the QR code with any authenticator app — Google Authenticator, 1Password, Authy, Bitwarden, the iCloud Keychain authenticator, or whichever you already use.
4. Enter the 6-digit code your app shows to confirm the link works.
5. Save your recovery codes somewhere safe (more on those below).

That's it. Next time you sign in, you'll enter your password as usual and then a 6-digit code from your authenticator.

Recovery codes

When you turn on two-factor, we generate 8 one-time recovery codes. Each code works exactly once and lets you sign in without your authenticator — useful if you lose your phone or switch devices.

• They're shown to you once, right after you enroll. Save them in a password manager, print them, or write them down.
• We hash them in our database, so we can't show them to you again later. If you lose them, you can regenerate a fresh set from Account → Security (you'll need a current authenticator code or one remaining recovery code to do so).
• Each recovery code is a 10-character string. We accept it with or without dashes when you enter it, so the format on the page doesn't matter.

Signing in with two-factor

After your password, we'll show a short challenge page asking for your 6-digit code. You can use either a code from your authenticator app or one of your recovery codes. The challenge expires after 3 minutes — if you take too long, just sign in again and we'll show a fresh challenge.

Turning it off, or starting over

From Account → Security:

• Disable two-factor removes it entirely. We require a current code (TOTP or recovery) to confirm — this protects you if someone has briefly accessed your password.
• Regenerate recovery codes invalidates your old codes and gives you a fresh set of 8. Same confirmation requirement.

Lost both your authenticator and your recovery codes? Open a ticket with our support team — we'll walk you through identity verification and help you regain access.

Why we built it portal-side

We run our own TOTP verifier rather than relying on a third-party 2FA service, so:

• Your enrollment, codes, and recovery codes never leave Flashcloud's infrastructure.
• The challenge stays inside the portal — no redirect to an external login page.
• We can rotate the underlying signing keys without you needing to re-enroll.