# Turn on two-factor authentication

> Protect your account with a 6-digit code from an authenticator app, keep your recovery codes safe, and turn two-factor off again.

Source: https://plexiidesk.com/help/account-two-factor
Section: Account, plans and support > Sign-in and security
Plans: All plans
Updated: 2026-10-15

Two-factor authentication adds a second step when you sign in. As well as your password, you enter a 6-digit code from an authenticator app on your phone or computer. Someone who learns your password still cannot sign in without the code.

## Before you start

- **Plan.** Two-factor authentication is on every plan.
- **Sign in.** You turn it on from your account in Settings. See [Create an account and sign in](https://plexiidesk.com/help/account-sign-in).
- **Have an authenticator app ready.** Any app or password manager that makes 6-digit sign-in codes from a secret key works.
- **Have somewhere safe for your recovery codes,** such as a password manager.

## Turn on two-factor authentication

1. Click the gear at the right-hand end of the header to open **Settings**.
2. Click the **Account** tab.
3. Under **Two-factor authentication**, which says **Off. Add a code from an authenticator app.**, click **Turn on**.
4. PlexiDesk shows a secret key, and below it a longer link that starts with otpauth://. In your authenticator app, add a new account and enter the secret key. Some apps let you paste the otpauth:// link instead.
5. Your authenticator app now shows a 6-digit code for PlexiDesk. Type it into the box in Settings.
6. Click **Verify and turn on**.
7. PlexiDesk shows ten recovery codes. Save them somewhere safe, then click **I saved them**.

The section now says **On. A code is required at each new sign-in.**

> **Note:**
> The recovery codes are shown only once. If you lose your authenticator app, a recovery code is how you get back in, so keep them somewhere other than the phone your app is on.

In your authenticator app, the account is listed as PlexiDesk with your email address.

## Sign in with a code

1. Enter your **Email** and **Password** and click **Log in**, as usual.
2. An **Authentication code** box appears. Open your authenticator app and type the 6-digit code it shows for PlexiDesk.
3. Click **Verify**.

Codes change every 30 seconds. If one is about to change, wait for the next one.

### Use a recovery code

If you do not have your authenticator app, type one of your recovery codes in the **Authentication code** box instead, including the hyphen in the middle, and click **Verify**. Each recovery code works once.

## Turn off two-factor authentication

1. Open **Settings** and click the **Account** tab.
2. Under **Two-factor authentication**, click **Turn off**.
3. Enter a current code from your authenticator app, or a recovery code.
4. Click **Turn off two-factor**.

Your recovery codes stop working when you turn two-factor off. If you turn it on again later, you set up the authenticator app again and get new recovery codes.

## Tips

- **Set it up on a second device too.** Adding the same secret key to an app on another device gives you a backup.
- **Running low on recovery codes?** Turn two-factor off and on again to get a fresh set of ten.
- **Changes are recorded.** If you belong to an organisation, its owners and admins see in the audit log when you turn two-factor on or off. See [Set up and manage your organisation](https://plexiidesk.com/help/org-manage#review-the-audit-log).

## Common questions

**It says "That code is not valid. Check your authenticator and try again."**
Check that you typed the code shown for PlexiDesk, and that it had not just changed. Codes depend on the time, so check that the clock on your phone is set automatically.

**I lost my phone.**
Sign in with one of your recovery codes, then turn two-factor off and on again to set up your new phone. If you have no recovery codes left, [contact us](https://plexiidesk.com/help/help-getting-help).

**Do I need a code every time I open PlexiDesk?**
Yes. You sign in each time you open PlexiDesk, and with two-factor on, each sign-in asks for a code.

**I reset my password. Is two-factor still on?**
Yes. Resetting your password does not change two-factor authentication. See [Reset a forgotten password](https://plexiidesk.com/help/account-forgot-password).

**Is there a QR code to scan?**
PlexiDesk shows the secret key as text. Type or paste it into your authenticator app.

## Related tasks

- [Create an account and sign in](https://plexiidesk.com/help/account-sign-in)
- [Account settings](https://plexiidesk.com/help/settings-account)
- [Reset a forgotten password](https://plexiidesk.com/help/account-forgot-password)
- [Single sign-on and directory sync](https://plexiidesk.com/help/org-sso-directory-sync)