# Turn on two-factor sign-in

> A code from your phone, on top of your password.

Source: https://docs.dashfordevs.com/v1/business-getting-started/two-factor-sign-in · Topic: Your first day · Updated: 2026-11-07

Two-factor sign-in means a stolen password alone cannot open your account. After your password, you also enter a short code from an authenticator app (or one we email you).

## Turn it on for yourself

1.  **Open your security settings.** Go to accounts.dashfordevs.com and open **Security**.
    
2.  **Choose a method.** An authenticator app (\[Google Authenticator\](https://support.google.com/accounts/answer/1066447), \[1Password\](https://1password.com/), Authy and similar) is the strongest. Email codes are the fallback.
    
3.  **Scan the QR code** with your app and type the six-digit code it shows.
    
4.  **Save your recovery codes.** They are shown once. Keep them somewhere safe, offline or in your password manager. Each one gets you in once if you lose your phone.
    

## Require it for everyone in your organization

Owners and Admins can make two-factor sign-in required for the organization, in its security settings. If your organization handles health data, turn this on: it is on the HIPAA checklist at hipaa.dashfordevs.com.

-   Members who have not set it up get a grace period with a reminder.
-   After that, they cannot open **this organization** until they set it up. Their account and any other organizations keep working.
-   The rule is checked for the session itself, not just the account: someone who signed in without the second factor is asked for it before entering the organization.

## If you lose your phone

Use a recovery code to sign in, then set up two-factor again on your new phone. If you have no recovery codes left, contact support; we verify who you are before resetting anything, and the reset is recorded.