Two-factor authentication adds a second step to your sign-in: even if someone has your password, they can't get into your account without the rolling 6-digit code from your phone. We strongly recommend enabling it.
Turn it on
- Sign in and go to Account → Security.
- Click Set up two-factor authentication.
- Scan the QR code with any authenticator app — Google Authenticator, 1Password, Authy, Bitwarden, the iCloud Keychain authenticator, or whichever you already use.
- Enter the 6-digit code your app shows to confirm the link works.
- Save your recovery codes somewhere safe (more on those below).
That's it. Next time you sign in, you'll enter your password as usual and then a 6-digit code from your authenticator.
Recovery codes
When you turn on two-factor, we generate 8 one-time recovery codes. Each code works exactly once and lets you sign in without your authenticator — useful if you lose your phone or switch devices.
- They're shown to you once, right after you enroll. Save them in a password manager, print them, or write them down.
- We hash them in our database, so we can't show them to you again later. If you lose them, you can regenerate a fresh set from Account → Security (you'll need a current authenticator code or one remaining recovery code to do so).
- Each recovery code is a 10-character string. We accept it with or without dashes when you enter it, so the format on the page doesn't matter.
Signing in with two-factor
After your password, we'll show a short challenge page asking for your 6-digit code. You can use either a code from your authenticator app or one of your recovery codes. The challenge expires after 3 minutes — if you take too long, just sign in again and we'll show a fresh challenge.
Turning it off, or starting over
From Account → Security:
- Disable two-factor removes it entirely. We require a current code (TOTP or recovery) to confirm — this protects you if someone has briefly accessed your password.
- Regenerate recovery codes invalidates your old codes and gives you a fresh set of 8. Same confirmation requirement.
Lost both your authenticator and your recovery codes? Open a ticket with our support team — we'll walk you through identity verification and help you regain access.
Why we built it portal-side
We run our own TOTP verifier rather than relying on a third-party 2FA service, so:
- Your enrollment, codes, and recovery codes never leave Flashcloud's infrastructure.
- The challenge stays inside the portal — no redirect to an external login page.
- We can rotate the underlying signing keys without you needing to re-enroll.