# Set up two-factor sign-in and test the way back in

Turn on two-factor sign-in for your Borago Board cloud account, save the recovery codes, add a recovery email and test signing in with each.

Two-factor sign-in protects your Borago Board cloud account with a code from an authenticator app on top of your password. No email is sent at sign-in. This tutorial turns it on, keeps two ways back in, and tests them while you still have your phone.

## You will build

A cloud account that asks for an authenticator code at sign-in, with saved recovery codes and a confirmed recovery email.

## You need

- A cloud account, signed in to the cloud board in a browser or on your phone. See [Cloud sync, browser and phone](/docs/guides/cloud-sync-browser-and-phone/).
- An authenticator app, such as Google Authenticator, 1Password or Authy.
- A second email address you can read, different from the one you sign in with.

## Steps

### 1. Open your profile

On the cloud board, open the profile menu in the top bar and press **Profile**.

What happens. The profile page shows **Two-factor authentication** and **Recovery email**. Both are changed here, on the cloud board. The desktop app's profile shows whether two-factor is on but cannot change it.

### 2. Start the setup

Beside **Two-factor authentication**, press **Set up**. The dialog **Set up two-factor authentication** shows a QR code.

What happens. The account gets a new secret, stored encrypted, and two-factor stays off until you prove the app has it. If you cannot scan, the dialog prints the key under **Can't scan? Enter this key manually**.

### 3. Scan and confirm

Scan the QR code with your authenticator app. Type the 6-digit code it shows into **Verification code** and press **Verify and enable**.

What happens. Two-factor is now on. The dialog changes to **Save your recovery codes** and lists them.

### 4. Save the recovery codes

Press **Copy** or **Download** and keep the codes somewhere safe, away from your phone. Then press **I have saved my recovery codes**.

What happens. Each code signs you in once, in place of an authenticator code. They are shown only this once. The board keeps only a fingerprint of each code, so nobody can show them to you again.

### 5. Add a recovery email

Under **Recovery email**, press **Add**. Type the second address in **Recovery email address** and your password in **Your password**, then press **Send confirmation code**. Type the code that arrives at that address and press **Confirm**.

What happens. The address is saved only once you prove you can read it. If you type your sign-in address, the form suggests a different one, so losing one inbox does not also lose the way back.

### 6. Sign out and sign in with the app

Open the profile menu, press **Log out**, then sign in with your email and password.

What happens. The form asks for **Authentication code**. Type the current code from your authenticator app and press **Verify**. Each code works once, so a code seen over your shoulder cannot be used again.

### 7. Sign in once with a recovery code

Log out again and sign in. At **Authentication code**, type one of your saved recovery codes instead and press **Verify**.

What happens. You are in, and that code is used up. Signing in with it a second time is refused.

### 8. Read the lost-authenticator path, without using it

Log out and sign in to the code step once more. Under the code field is **Can't access your authenticator?**. Do not press it now. Press **Back**.

What happens. Pressing **Can't access your authenticator?** emails a code to your recovery address. Entering it shows **Recovery scheduled**. Two-factor is removed after 24 hours, never at once, and your primary email receives a notice with a cancel link at the moment the hold starts. Signing in with your authenticator or a recovery code during the wait cancels it too. When the hold ends, you sign in with your password alone and set up an authenticator again.

## Check it worked

The profile shows **Enabled** under **Two-factor authentication**, and **Recovery email** names your second address.

## If you lose everything

Without your phone, your recovery codes and your recovery email, use **Forgot password?** on the sign-in page, then **Have an authenticator app? Reset without email**, then **Lost your authenticator too?**, and press **Request recovery**. That starts a 24-hour hold from your primary email alone. When it ends, two-factor is removed and a password reset email is sent. While it waits, the cancel link in the email and the **This was not me - cancel** button on a banner in any cloud board session still signed in both stop it. A plain emailed password reset does not remove two-factor on its own.

## Where to go next

To turn it off, press **Disable** beside **Two-factor authentication** and enter a current code or a recovery code.

Related: [Accounts](/docs/reference/accounts/), [Security](/security/), [Cloud sync, browser and phone](/docs/guides/cloud-sync-browser-and-phone/), [Switching accounts on one machine](/docs/guides/switching-accounts/)