Skip to main content
Two-factor authentication (2FA) asks for a 6-digit code from an app on your phone each time you sign in. Even if someone learns your password, they can’t get in without your phone.

Difficulty

Beginner

Time

5 minutes

Turn on 2FA

1

Install an authenticator app

Install an app such as Google Authenticator, Microsoft Authenticator, Authy or 1Password on your phone.
2

Open the Two-factor Authentication tab

Go to Account and click Two-factor Authentication.
3

Scan the QR code

In the TOTP App Based box, scan the QR code with your app. Can’t scan? Type the secret key shown under the QR code into the app instead.
4

Enter the code and activate

Type the 6-digit code from your app into the six boxes, then click Activate App Based TOTP. The code changes every 30 seconds, so use the current one.
5

Save your backup codes

Click Backup codes. Ten single-use codes appear. Store them somewhere safe, such as a password manager. Each code works once and lets you sign in if you lose your phone.
Backup codes reminder with a Backup codes button and a list of ten single-use codes, blurred

Your backup codes (blurred here)

The tab now says TOTP App Based two-factor authentication is enabled on this account, and the Account card on your Dashboard shows Two-factor Authentication: ACTIVE.
Two-factor Authentication tab saying TOTP App Based two-factor authentication is enabled, with Deactivate and Backup codes buttons and an empty Trusted Devices list

2FA turned on

Have a YubiKey? Use the YubiKey OTP box below the app option instead: click in the field, insert your YubiKey and tap it, then click Activate YubiKey.

Turn off 2FA

Click Deactivate, then Deactivate again in the red warning window. We recommend keeping 2FA on: without it, your password is the only thing protecting your servers.

Trusted devices

After you sign in with a code, that browser becomes a trusted device for a while, so you aren’t asked for a code every time. The Trusted Devices list shows each one with its Device, OS, Browser, IP Address, when it was Last Used and when it Expires. Your current browser is marked CURRENT.
  • Click Remove to make one device ask for a code again.
  • Click Remove All to clear every trusted device, for example after losing a laptop or using a shared computer.

Lost your phone?

Enter a backup code instead of an app code when you sign in. Then set up 2FA again on your new phone.
Open a ticket with VPS & Dedicated Servers from the email address on your account. We’ll verify your identity before resetting 2FA.
Most authenticator apps can transfer codes to a new phone. Do this before you wipe the old one, or sign in with a backup code and set up 2FA again.

Need Extra Help?

If you encounter any issues, our support team is ready to assist:

Save on Your Hosting

Ready to get a new server? Use code KB20 at checkout for 20% off your first month!

Last Updated: October 2026