Two-factor authentication for your account
Your account controls real servers and real money on the balance. A leaked password shouldn't be enough to get in, and two-factor authentication (2FA) makes sure it isn't: after the password, or the email code, you also enter a six-digit code from an app on your phone.
Turning it on
- Open the "Security" tab in your account and press "Enable 2FA".
- Scan the QR code with any authenticator app: Aegis, 2FAS, Google Authenticator, a password manager with TOTP support. If you can't scan, type in the key shown under the code.
- Enter the six-digit code from the app to confirm.
Then you get eight recovery codes. Each one works once, instead of the app code. Save them somewhere other than your phone: a password manager, or simply on paper. They're shown only this once.
Enabling 2FA signs out every other session of your account. That's on purpose: if someone already had access, they lose it.
Signing in
Sign in as usual with your password or an email code. On the next screen, enter the code from the app. If your phone is out of reach, a recovery code works in the same field.
Lost the phone
Sign in with a recovery code, then on the "Security" tab turn 2FA off and set it up again on the new phone. You can also generate a fresh set of recovery codes there; the old set stops working.
No phone and no recovery codes? Open a ticket from the email of your account. We'll ask a few questions to make sure it's really you, and only then remove 2FA. It's slower than we'd like, and that's the point.
Sessions
The same tab lists the devices that are signed in to your account, with IP address and sign-in time, and shows recent sign-ins. See something you don't recognise? Sign it out, change your password and turn on 2FA if you haven't yet.