Turn on two-factor sign-in

Two-factor sign-in means a stolen password alone cannot open your account. After your password, you also enter a short code from an authenticator app (or one we email you).

#Turn it on for yourself

1. Open your security settings. Go to accounts.dashfordevs.com and open Security.

2. Choose a method. An authenticator app ([Google Authenticator](https://support.google.com/accounts/answer/1066447), [1Password](https://1password.com/), Authy and similar) is the strongest. Email codes are the fallback.

3. Scan the QR code with your app and type the six-digit code it shows.

4. Save your recovery codes. They are shown once. Keep them somewhere safe, offline or in your password manager. Each one gets you in once if you lose your phone.

#Require it for everyone in your organization

Owners and Admins can make two-factor sign-in required for the organization, in its security settings. If your organization handles health data, turn this on: it is on the HIPAA checklist at hipaa.dashfordevs.com.

• Members who have not set it up get a grace period with a reminder.
• After that, they cannot open this organization until they set it up. Their account and any other organizations keep working.
• The rule is checked for the session itself, not just the account: someone who signed in without the second factor is asked for it before entering the organization.

#If you lose your phone

Use a recovery code to sign in, then set up two-factor again on your new phone. If you have no recovery codes left, contact support; we verify who you are before resetting anything, and the reset is recorded.