> For the complete documentation index, see [llms.txt](https://docs.yeymail.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.yeymail.com/using-yeymail/two-factor-authentication.md). # Two-factor authentication Two-factor authentication asks for a six-digit code from an app on your phone, on top of your password, every time you sign in. It matters more here than on most services. Your YeyMail account controls every alias you own **and** the real inbox they forward to. Someone who gets your password does not just read this account. They can repoint every alias at themselves, and your mail starts arriving somewhere else without a single message going missing from where you would notice. ## Turning it on You need an authenticator app. Any standard one works: 1Password, Bitwarden, Authy, Google Authenticator, Microsoft Authenticator, or the code generator built into iOS and Android password settings. 1. Go to **Settings** and find **Two-factor authentication**. 2. Enter your password, then choose **Set up two-factor**. 3. **Scan the QR code** with your app. If you are setting up on the same phone that runs the app (so there is nothing to point a camera at), tap **Copy** under "Can't scan?" and paste the key into the app instead. 4. **Enter the six-digit code** your app now shows. This step is what proves the pairing actually worked; nothing is switched on until it passes. 5. **Save your recovery codes.** See below. This is the part people skip and later regret. Turning 2FA on signs you out on every other device. That is deliberate: people often turn it on precisely because they think someone else has got in, and leaving old sessions alive would mean the intruder never sees a code prompt. ## Recovery codes You get ten. Each one works once, in place of a code from your app. **We show them exactly once.** They are stored only as hashes, so we cannot display them again later — not through support, not through an export. If you did not save them, generate a fresh set from Settings; doing so cancels the old ones. Keep them somewhere that is not the phone running your authenticator app. A printout in a drawer, a password manager on a different device, a note in a safe. The whole point is that they survive losing the phone. When you use one to sign in, we email you to say so. If that email arrives and it was not you, change your password immediately. Whoever did it already knows the old one. ## If you lose your phone Sign in with a recovery code. On the code screen, choose **Use a recovery code instead** and enter one. Then go to Settings and either pair a new app or generate fresh recovery codes. **If you lose both your app and your codes,** email . We can reset two-factor on your account, but we will need to verify that it is yours first, and that takes several days. There is no faster route and no back door: an account recovery that a stranger could talk their way through would make the whole feature pointless. ## Signing in with Google Google sign-in does **not** skip the code. Our second factor is a statement about this account, not about which button you used to reach it, so anyone holding a live Google session still has to produce a code. ## Common problems **"That code is not right" even though I copied it carefully.** Almost always a clock problem: the codes are derived from the current time, so a phone whose clock has drifted generates codes for the wrong moment. Turn on automatic time in your phone's date and time settings. In Google Authenticator there is also a **Time correction for codes** option under settings. **The code changed while I was typing.** Codes rotate every 30 seconds. We accept the one before and the one after the current window, so a few seconds either way is fine; just enter the newest one rather than finishing the old one. **"Too many incorrect codes. Try again in a few minutes."** After ten wrong codes in a row the account stops accepting them for fifteen minutes. Wait it out, then check your phone's clock before trying again. **I want to move to a new phone.** Turn two-factor off in Settings, then set it up again and scan the new QR code. Your old recovery codes are cancelled when you turn it off, and you get a new set at the end. ## Turning it off Settings → **Two-factor authentication** → **Turn off**. You will need your password. Your recovery codes are cancelled at the same time, and we email you to confirm, because turning 2FA off silently is exactly what someone who has taken an account would want to do. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.yeymail.com/using-yeymail/two-factor-authentication.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.