# Two-factor authentication (/security/two-factor-authentication) Two-factor authentication (2FA) is opt-in for every user. Once enabled, signing in takes a password plus a second, short-lived code — so a leaked password alone isn't enough to get in. ## Choosing a method At enrollment, pick one of two methods: * **Authenticator app (TOTP)** — scan a QR code with an app like Google Authenticator or Authy, then enter the six-digit code it generates to confirm setup. Once confirmed, **10 one-time backup codes** are shown — this is the only time you'll see them, so store them somewhere safe. * **Email code** — a one-time code is emailed to you at sign-in. Simpler to set up, but there are no backup codes with this method; losing access to the mailbox means losing access to this factor. ## Signing in After your password, a second step asks for the current code. TOTP users who don't have their app handy can enter one of their backup codes instead — each backup code works once. ## Managing 2FA Enroll, switch methods, or disable 2FA from **Settings → Security**. Disabling requires entering a current code first, so a session hijacked after login can't turn 2FA off on its own. ## Recovery Locked out — lost the authenticator, used up your backup codes, or lost access to the 2FA email? Contact Bitelio support to reset your 2FA so you can sign in and re-enroll. Resetting another person's 2FA is a platform-support action; a project's own Owners and Admins cannot reset a teammate's 2FA from the dashboard. Note that email-code 2FA depends on the platform's email notifications being configured; if you're unsure whether that's the case in your environment, the authenticator app method has no such dependency. ## What's next See what a member can do once they're signed in. Back to the overview of the access-control surface.