Two-factor authentication

Protect your account with TOTP-based 2FA and one-time backup codes, enabled from Account → Security.

Two-factor authentication (2FA) adds a time-based one-time password (TOTP) on top of your password. Once enabled, sign-in requires a 6-digit code from an authenticator app such as Google Authenticator, 1Password, or Authy.

Why a password alone isn't enough

A password is a single secret, and single secrets leak: reused across sites, caught by a phishing page, pulled from a breached database that has nothing to do with NevTan. 2FA assumes your password will eventually leak somewhere and adds a second factor — something you physically hold (your phone, running the authenticator app) — so a leaked password alone isn't enough to sign in. It's the single highest-leverage thing you can do to protect an account, because it defends against the most common real-world compromise: a reused or phished password, not some exotic attack on NevTan itself.

What 2FA protects

2FA guards your account login specifically — it stops sign-in even if your password is compromised. It's a different layer from API keys, which name a credential used by NevTan's own integrations, and SSH keys, which protect shell access to an instance. Enable all three where they apply; they don't substitute for each other.

How enrolment works

1. 1
   Turn on the toggle

   Open Account → Security and switch on two-factor authentication. The console generates a shared secret and displays it as a QR code.
2. 2
   Scan and confirm

   Scan the QR code with your authenticator app (or enter the secret manually), then type the 6-digit code it generates into the confirm field.
3. 3
   Save your backup codes

   Once confirmed, the console shows a set of one-time backup codes. Store them somewhere safe — each can stand in for a TOTP code exactly once if you lose your device.

Signing in with 2FA on

From now on, signing in prompts for a TOTP code after your password. If you don't have access to your authenticator app, enter one of your backup codes instead.

Losing your device

If your phone is lost, wiped, or replaced, you don't need your old device to sign in again — a backup code stands in for a TOTP code and gets you past the 2FA prompt on any new device. Once you're signed in, go straight to Account → Security and regenerate 2FA: re-enrol a fresh authenticator on your new device and get a new set of backup codes. Treat every used backup code as burned even if sign-in doesn't immediately consume it — the safest assumption is that a code you've typed once shouldn't be trusted again.

If you've also lost your backup codes

Losing the authenticator device and the backup codes at the same time is the scenario 2FA is explicitly designed to make hard to recover from — that's what makes the second factor meaningful in the first place. It's also why the enrolment flow front-loads the backup codes step and why the guidance is to store them somewhere durable and offline from the device running your authenticator app, rather than as a photo on the same phone. Practically, this means the codes deserve the same treatment as a spare house key: written down or saved somewhere you'd still have it if your phone disappeared today.

Disabling 2FA

To turn 2FA off, open Account → Security and confirm a current code — either a live TOTP code from your app or one of your backup codes.