# Turn on two-factor sign-in

> Sign in with your password and a code from your phone, so a stolen password alone can't open your account.

Source: https://docs.soosh.io/guides/workspace/turn-on-two-factor-sign-in/

Two-factor sign-in asks for a 6-digit code from an app on your phone each
time you sign in with your password. Anyone who learns your password still
can't get in without your phone.

## Before you start

- A Soosh account you sign in to with a password
- An authenticator app on your phone, like Google Authenticator, Microsoft Authenticator or 1Password

If you sign in with Google or your company's sign-in, there's nothing to set
up: they check who you are themselves. See
[Sign in with single sign-on](https://docs.soosh.io/guides/workspace/sign-in-with-single-sign-on/).

## Turn it on

1. Click your name at the bottom of the sidebar, then **Profile**.
2. Under **Two-factor sign-in**, click **Turn on**.
3. Scan the QR code with your authenticator app, then click **Next**. If you
   can't scan it, click **Can't scan it? Enter a setup key** and type the key
   into the app. On a phone, tap **Open in authenticator app** instead.
4. Enter your password, then the 6-digit code your app shows.
5. Click **Turn on**.
6. Save your 10 recovery codes: click **Download** or **Copy all**, and keep
   them somewhere safe, like a password manager.
7. Tick **I've saved these codes** and click **Done**.

We email you to say it's on. Other browsers signed in to your account are
signed out, and sign in again with a code.

## Sign in with it

After your password, Soosh asks for a code. Open your authenticator app and
enter the 6-digit code it shows for Soosh. To use something else, click
**Try another way** under **Verify** and pick:

- **Email me a code**: we email you a code for this sign-in.
- **Recovery code**: each code works once. We email you when one is used.

Signing in as someone else? Click **Not you?** next to your email at the top.

> **Note:** Soosh doesn't email codes to Soosh staff accounts, or to anyone for 7 days
> after they reset their password by email or their sign-in email changes. Use
> your app or a recovery code then.

## Change your sign-in email

With two-factor sign-in on, changing the email you sign in with takes your
current password and a code from your app (or a recovery code), not your
password alone. Codes by email go to that address, so this keeps someone who
learns your password from moving them to their own inbox. You then sign in
again everywhere, and we email your old address to say it changed.

## Got a new phone?

Move two-factor sign-in to it yourself. You need your old phone or one of
your recovery codes. It stays on the whole time, even if a workspace requires
it.

1. In **Profile**, under **Two-factor sign-in**, click **Use a new phone**.
2. Enter your password, then the 6-digit code from your old phone. Soosh
   goes on to the next step as soon as the code is complete. No old phone?
   Click **Use a recovery code** and enter one instead.
3. Scan the QR code with the authenticator app on your new phone, then click
   **Next**.
4. Enter the 6-digit code your new app shows. Soosh checks it as soon as
   it's complete, and you're done.

Codes from your old phone stop working. Your recovery codes stay the same
(less the one you used, if you used one). Other browsers signed in to your
account are signed out, and we email you to say it moved.

If you have neither your old phone nor a recovery code, write to the support
address shown under the fields in **Use a new phone** (it's also in **Trouble
signing in?** under the sign-in form, and in our emails about two-factor
sign-in). Without one, ask your workspace owner to contact Soosh support.

## If codes from your app don't work

Codes change every 30 seconds, so enter the newest one your app shows. If
codes keep failing, your phone's clock is probably off. Set your phone's
date and time to automatic in its settings, then try a new code.

## If you lose your phone

- Sign in with a recovery code, or with a code by email.
- Then [move to your new phone](#got-a-new-phone), with a recovery code in
  place of a code from your old phone. Each code works once, so use a
  different one from the code you signed in with.
- If you have no recovery codes left, write to the address in **Trouble
  signing in?** under the sign-in form, in **Use a new phone** and in our
  emails about two-factor sign-in, or ask your workspace owner to contact
  Soosh support.
  Soosh support can reset it for you, and we email you when they do. You then
  sign in with only your password. If a workspace requires it, you're asked
  to turn it on again straight away.

## Related

- [Require two-factor sign-in for your workspace](https://docs.soosh.io/guides/workspace/require-two-factor-sign-in/)
- [Sign in with single sign-on](https://docs.soosh.io/guides/workspace/sign-in-with-single-sign-on/)