# Two-step verification

> A six-digit code from an app on your phone, on top of your password - how to turn it on, and what it does and does not protect.

Source: https://www.revquix.com/docs/account/two-step-verification
Last verified: 2026-09-03

---

Two-step verification asks for a code from your phone in addition to your usual sign-in. It is the
single most effective thing you can do to protect the account, because it stops somebody who already
has your password.

## Turning it on

1. **Pick an authenticator app.** Google Authenticator, Authy, 1Password, Microsoft Authenticator -
   any of them. The setup screen suggests some.
2. **Scan the QR code.** If you cannot scan - setting it up on the same device you are reading this
   on, for instance - there is a key you can type instead.
3. **Enter the code the app shows** to prove it worked.
4. **Save your recovery codes.** Do not skip this step; see [recovery codes](https://www.revquix.com/docs/account/recovery-codes).

## How the codes work

Six digits, changing every 30 seconds, generated on your device from a shared secret. Nothing is
sent to your phone, so it works with no signal and on a plane.

> **Note** - If your codes are always rejected, check your phone's clock
>
> The code is derived from the current time, so a device whose clock has drifted generates confident,
> wrong codes. Turning on automatic time in your phone's settings fixes essentially every case of this.

## What it protects, and what it does not

**It protects sign-in.** Someone with your password cannot get in without your phone.

**It does not protect** a session already signed in on a device someone else has. For that, sign that
session out - see [active sessions and login history](https://www.revquix.com/docs/account/active-sessions-and-login-history).

## Turning it off

You can, and you have to verify first. Doing so leaves your password as the only thing between an
attacker and the account.

> **Warning** - Losing your phone is not a reason to turn it off
>
> That is what recovery codes are for. Use one to get in, then re-enrol on the new device.

## If you are an admin

Admin accounts carry more risk and the platform has the machinery to require enrolment for them.
Whether that requirement is currently switched on is an operational decision rather than a permanent
rule, so the settings screen is the authority - if enrolment is being required of you, it will say so
and give you a deadline.

Either way, an admin who has not enrolled is the weakest point in the system. Enrol before you are
asked.

- [Recovery codes](https://www.revquix.com/docs/account/recovery-codes) - Your way back in.

- [Your password](https://www.revquix.com/docs/account/your-password) - The first factor.