# Two-Factor Authentication > Turn on two-factor authentication with an authenticator app, sign in with the verification step, turn it off, and what to do if you lose your device. Source: https://docs.theavoxai.com/security/two-factor Two-factor authentication adds a second step to signing in: after your password (or Google or Facebook), you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't get in without your phone. It's set per person, for your own account, in **Settings > Security > Two-factor authentication**. Any member can turn it on, whatever their role. ## What you need An authenticator app - Google Authenticator, Authy, 1Password, and similar apps all work. Each one shows a new 6-digit code roughly every 30 seconds. ## Turning it on **1. Click Enable** On the **Two-factor authentication** card ("Add a second step at sign-in using an authenticator app"). A QR code appears. **2. Add Avox to your authenticator app** Scan the QR code with the app. If you can't scan it, use the key under "Can't scan? Enter this key manually:" - the copy button next to it copies it for you. **3. Enter the code** Type the 6-digit code the app shows and click **Verify**. **4. Done** You see "Two-factor authentication is on", the card shows **On** - "an authenticator app code is required at sign-in", and you get a "Two-factor authentication is on for your Avox account" email. Changed your mind halfway? Click **Cancel** - nothing is turned on. Errors: [AVX-3088](https://docs.theavoxai.com/error-codes/avx-3088) (setup couldn't start), [AVX-3089](https://docs.theavoxai.com/error-codes/avx-3089) (the code didn't work - codes only last about 30 seconds, so check your phone's clock is right and try the next one). ## Signing in with two-factor on **1. Sign in as usual** With your password, a passkey, Google, or Facebook. **2. The verification step** The sign-in card changes to **Two-factor authentication** - "Enter the 6-digit code from your authenticator app to finish signing in." **3. Enter the code** Type the 6 digits from your app. The code is checked as soon as the last digit is in - there's nothing to click. You go straight on to your dashboard (or the page you were opening). If you open a dashboard link before finishing this step, the dashboard shows the same verification step first. Until the code is entered, every page sends you back to it, and your account stays closed - a password on its own opens nothing. Once you're through, you stay signed in for the usual length of a session. - A wrong code shows "That code didn't work. Check your authenticator app and enter the newest code." The boxes clear so you can type the next code. - Too many wrong codes in a row show "Too many tries. Wait a minute, then try again." - **Sign in with a different account** signs you out and takes you back to the sign-in form. - **Use a different method** explains what to do if you can't get a code - see [If you lose your phone](#if-you-lose-your-phone). - If you see "This account needs a second sign-in step we can't show here. Contact Avox support for help.", email hello@theavoxai.com from your account's email address. ## Resetting your password with two-factor on [Forgot password?](https://docs.theavoxai.com/security#forgot-your-password) asks for the code from your authenticator app too, after the code we email you and before you choose a new password. An emailed code alone can't change the password of a two-factor account. ## Turning it off Click **Disable** on the card. Because you're already signed in with both steps, no extra code is needed. You see "Two-factor authentication is off" and get a "Two-factor authentication was turned off" email - if you didn't do it, change your password straight away and reply to that email. If turning it off fails, you see [AVX-3090](https://docs.theavoxai.com/error-codes/avx-3090). ## Changing phones Two-factor uses one authenticator at a time. To move to a new phone while you still have the old one: 1. Sign in, completing the verification step with the old phone. 2. Click **Disable** in **Settings > Security**. 3. Click **Enable** and scan the new QR code with the new phone. Many authenticator apps can also move their accounts to a new phone themselves - check your app's own settings. ## If you lose your phone The verification step needs a code from your authenticator app. If you can't get one: - If your authenticator app syncs to another device you still have, open it there and use the code it shows. - Otherwise, email hello@theavoxai.com from your account's email address and the Avox team will help you get back in. A person on the team checks it's really you first. Use **Sign in with a different account** on the verification step to leave it in the meantime. > **Tip** > > Before you change or reset your phone, turn two-factor off and on again with the new phone (see > [Changing phones](#changing-phones)), so you're never left without a code. ## Related - [Security](https://docs.theavoxai.com/security) - every security setting. - [Sessions](https://docs.theavoxai.com/security/sessions) - see and sign out other devices. - [Emails](https://docs.theavoxai.com/emails#security-notices) - the security emails Avox sends.