# 2FA Authenticator — everything on authenticator.sh, as text Open-source (MIT) Chrome extension, free to use, that generates TOTP two-factor authentication codes — the same six-digit codes as Google Authenticator — inside the browser, on a computer. No sign-up. Secret keys, account names and codes never reach our servers. Current version 1.15.1. Not affiliated with Google. ## Frequently asked questions ### How do I add a new account? (https://www.authenticator.sh/faq#add-account) You can add an account in four ways: 1. Manual entry: click "Add Account" and type the account name and secret key from your service's 2FA setup page. 2. QR code: click "Add Account", switch to the "QR Code" tab and upload a screenshot or photo of the code — or scan it with your camera, or straight off the screen. 3. Paste a link: Settings → "Paste links". One otpauth:// link, or a whole list of them, one per line. This is how you move a hundred accounts from another app in a single action. 4. A file: import a .txt of otpauth:// links, a backup from this extension, or a CXF file from another authenticator. ### Where do I get the QR code or the secret key? (https://www.authenticator.sh/faq#secret-key) From the service you are protecting — Gmail, GitHub, your bank — not from this extension. The extension never sends a QR code or a key by email or text message: it reads the one the service shows you and turns it into codes. 1. Sign in to the service and open its security settings 2. Turn on two-factor authentication (sometimes called 2-step verification). If it offers text messages or email first, choose the authenticator app option — that is the one that shows a QR code 3. The QR code appears on the screen. In the extension: Add Account → QR Code → "Scan QR from screen" 4. Can't scan it? Look for a "Can't scan the QR code?" or "Enter manually" link next to it. It reveals the secret key — usually 16–32 characters, letters A–Z and digits 2–7, for example JBSWY3DPEHPK3PXP. Add it with Add Account → Manual → "Secret Key" 5. Type the six-digit code from the extension back into the service. Until you do, two-factor authentication is not on ### Does the extension need access to the website? Where do I allow it? (https://www.authenticator.sh/faq#site-access) No — there is nothing to allow. The extension asks for no access to websites in advance. Chrome lets it look at a page only at the moment you use it there: • "Scan QR from screen" captures the page in front of you when you click it. The access comes from opening the extension with its toolbar icon on that page • "Insert 2FA code" in the right-click menu fills the field you right-clicked — the right-click itself is the permission. It is on by default; Settings → "Right-click to insert a code" turns it off and on So Chrome's "Site access" menu for this extension has nothing to switch on, and "On all sites" is not needed. If "Scan QR from screen" says it couldn't capture the page: • Chrome protects some pages from every extension — its own settings pages, the Chrome Web Store, PDFs. The QR code has to be on an ordinary web page • If you opened the extension before going to the page with the QR code, close it and open it again from the toolbar icon on that page • Or save a screenshot of the QR code and use Add Account → QR Code → "Choose Image" "Scan QR with camera" is different: it opens a page that asks to use your camera. If you clicked Block, allow the camera for that page in Chrome's site settings — the icon at the left of the address bar — and try again. ### Why is one account marked "Suggested"? How do I turn it off? (https://www.authenticator.sh/faq#suggested-account) When you open the extension on a website, it highlights the account that matches that site and marks it "Suggested", so you do not have to look for it. It also remembers which account you used on each site. To turn it off: Settings → "Browser" → "Suggest account for this site". Turning it off also erases what it remembered. It reads only the address of the tab you are on, and only while the extension is open. None of it is sent to our server. ### Why are my codes not working? (https://www.authenticator.sh/faq#codes-not-working) Usually the code itself is fine — it belongs to a different QR code than the one the website is waiting for. The extension checks the time on its own, so there is nothing to change on your computer. What usually happened, and what to do: • The website made a new QR code. It does that whenever its setup page is reloaded or opened again, and the account you added first stops matching. Start the setup on the website again, add the QR code that is on the screen now, and type its code in straight away • The code came from another entry. If the same website is in the list twice, the newest entry is the one that works — and during setup the website wants the code of the account you just added • Two-factor was already set up somewhere else, such as an app on your phone. The extension shows codes only for accounts added to it. To move that account here, set up the authenticator on the website again, this time with the extension • The website wants a different code — one it sent you by text message or email, not one from an authenticator app If the code is about to change, wait for the next one. Before you delete an old entry, export a backup first (Settings → "Export"). And if the extension itself shows a warning about the time, do what it says. ### How do I backup my accounts? (https://www.authenticator.sh/faq#backup) To backup your accounts: 1. Click the Settings icon (gear) 2. Click "Export" 3. Choose how to save the file: • Protected with a password (recommended) — the file is useless to anyone who does not know the password. Remember it: the file cannot be opened without it. • Plain file — the whole backup as readable JSON. Only for a location you fully control. • otpauth:// links — one link per line in a .txt file. Almost any other authenticator can read this, which makes it the format to use for moving somewhere else. • Standard format (CXF) — the FIDO interchange format other password managers and authenticators accept. Only the first of those is encrypted. The other three hold your secret keys in the clear, and anyone with that file can generate your 2FA codes. ### How do I restore from backup? (https://www.authenticator.sh/faq#restore) To restore accounts from a backup: 1. Click "import from backup" on the main screen 2. Choose the file — a backup from this extension (JSON), a .txt of otpauth:// links, or a CXF file from another authenticator 3. If the file is password protected, enter its password when asked 4. The accounts are imported — on a new installation, as many as the free plan holds, or all of them with Pro. Nothing is imported halfway without asking you first. If you have the links as text rather than as a file, Settings → "Paste links" takes them directly. Note: This will add to your existing accounts, not replace them. ### Can I use this on multiple devices? (https://www.authenticator.sh/faq#multiple-devices) Yes — on every computer where Chrome is signed in to the same Google account: 1. Install the extension on the other computer 2. Sign in to Chrome there with the same Google account and turn sync on, with Extensions included in what Chrome syncs 3. In the extension, check that Settings → "Sync across devices" is on. It is on by default 4. Your accounts appear on the other computer, usually within a few minutes If Settings says "Too many accounts to sync — they stay on this computer", Chrome's sync can't carry that many. Move them by hand instead: Settings → "Export" on one computer, "Import" on the other. A password-protected file is the safest choice. There is no phone version: Chrome on phones doesn't run extensions. To have the codes on your phone too, scan the service's QR code with a phone authenticator app as well when you set up two-factor authentication — both will show the same codes. ### What if I delete an account by mistake? (https://www.authenticator.sh/faq#deleted-account) If you delete an account by mistake: 1. Click the Settings icon (gear) and open "Automatic copies" under "Backup & Restore". The extension takes a copy of your accounts once a day and keeps the last 7. 2. Click "Restore" next to a copy from before the account was deleted. Restoring only adds the accounts that are missing — nothing you have now is changed. 3. Not in any copy? Restore it from a backup file you exported: "Import" in the same section. 4. Not there either? Then the way back is through the service itself: while you are still signed in there, turn 2FA off and on again and add the new QR code. The automatic copies live inside the extension. Removing the extension or clearing the browser's data deletes them too — so don't reinstall the extension to get an account back. ### Why do I see a time sync warning? How do I fix it? (https://www.authenticator.sh/faq#time-sync) TOTP codes are generated from your device clock, so if it drifts more than ~30 seconds from real time, services will reject your codes. How to fix it: • macOS: System Settings → General → Date & Time → turn on "Set time and date automatically" • Windows: Settings → Time & language → Date & time → turn on "Set time automatically", then click "Sync now" • Linux: enable NTP / automatic date & time in your settings After syncing, reopen the extension — the warning disappears and your codes will be accepted again. Only your device clock needs fixing; the codes themselves are still generated offline. ### What's the difference between Algorithm/Digits/Period? (https://www.authenticator.sh/faq#algorithm-digits-period) These are advanced settings (usually defaults work): • Algorithm: Hash function used to derive the code (SHA1 is standard) • Digits: Code length (6 is most common, some use 8) • Period: How long codes are valid (30 seconds standard) Most services use: SHA1, 6 digits, 30 seconds. ### Is my data secure? (https://www.authenticator.sh/faq#data-security) Your accounts are stored in your browser — on your device, and in Chrome Sync under your own Google account if sync is on. Your secret keys, account names and codes never reach us. • Secret keys never leave your device • Automatic local backups (last 7) in case something goes wrong • Stored in Chrome storage, with sync as an optional second copy By default your codes are stored unencrypted and are protected by your computer login and Chrome profile — the same as most authenticator extensions. For stronger protection, turn on password protection in Settings: your codes are then encrypted on your device, including the backups, and cannot be read without your password. The extension does check in with our server once a day, for the free plan and Pro — with an anonymous id and a few numbers, never your accounts. "What does the extension send to your server?" below lists everything it sends. ### What does the extension send to your server? (https://www.authenticator.sh/faq#what-is-sent) Once a day the extension checks in with our server, api.authenticator.sh, so that the free plan and Pro work. It sends: • a random id created by this installation — not linked to your Google account, your email or your browser, unless you buy Pro: then your purchase links it, and any other installation where your license key is active, to the email address you paid with • the extension version, its language and your browser's language • when it was installed, and whether that was before version 1.14.0 • how many accounts you have — a number, never which ones • whether password protection and sync are on, and whether it opens as a popup, a window or a side panel, and which style it uses, light or dark • which free-plan policy and license it currently holds, and whether it already has your license key • a short list of billing events: the limit was reached, the Pro screen was shown or closed, a plan was chosen, a checkout or a license key was tried Our server works out your country from the request; your IP address is not stored. It never sends your secret keys, account names, issuers, codes, or the sites you use them on. When you uninstall, the feedback page receives the same id: as it opens it tells our server that installation was removed, and an answer — if you give one — is linked to it. The privacy policy has the details, and the code that builds the request is open source. ### How do I protect my codes with a password? (https://www.authenticator.sh/faq#password-protection) Open Settings and turn on "Password protection". Your codes are then scrambled on this device, so nobody can read them without your password — not someone using your computer, not a virus that steals browser data, and not through your Google account sync. You will also get a recovery code. Save it somewhere outside this browser: it is the only way back in if you forget your password. We cannot reset it for you. You choose how often the password is asked for: every time, after a few minutes idle, or once until the browser closes. You can turn the protection off again at any time with your password. ### Can I import from Google Authenticator? (https://www.authenticator.sh/faq#import-google-authenticator) Yes. Google Authenticator exports your accounts as a QR code on the phone, and the extension reads it with your computer's camera: 1. Open Google Authenticator on your phone 2. Tap the ⋮ menu (top right) → "Transfer accounts" → "Export accounts" 3. Pick the accounts and tap Next. Your phone now shows a QR code 4. In the extension: Add Account → QR Code → "Scan QR with camera", and point your computer's camera at the phone screen 5. Exporting many accounts? Google Authenticator splits them across several QR codes — tap Next on the phone and scan each one No camera on this computer? Photograph the QR code with another phone or camera, send the picture to your computer, and use Add Account → QR Code → "Choose Image". A screenshot won't do: on Android, Google blocks screenshots of that export screen, so a second device is the only way to capture it. "Scan QR from screen" doesn't help here either — it reads codes shown on this computer's screen, not on your phone. No second device either? Then set the accounts up again one service at a time: on the website turn two-factor authentication off and straight back on, and use Add Account → QR Code → "Scan QR from screen". If you already have the transfer link as text — it starts with otpauth-migration:// — paste it into Settings → "Paste links" instead. Keep Google Authenticator on your phone until a code from the extension has been accepted. ### What happens if I lose my backup? (https://www.authenticator.sh/faq#lost-backup) If you lose access to this extension and have no backup: 1. You'll need to disable 2FA on each affected service 2. Then re-enable 2FA and add accounts again 3. Keep recovery codes from services in a safe place Prevention: Export backups regularly and store them securely! ### Is it free? (https://www.authenticator.sh/faq#is-it-free) Yes, to use. The extension is free to install, and the free plan has every feature except cloud backup: • Installations from before version 1.14.0 keep unlimited accounts, free. Nothing changes for them. • New installations may have a limit on how many accounts they hold for free. Pro removes the limit and adds an encrypted cloud backup. • The limit only ever stops adding an account. Every account you already have keeps its code, and export, backups, restoring and sync keep working — with or without Pro, and after a subscription ends. The limit is checked on your computer, from the last policy our server signed, so a limit the extension has already received applies offline too. Until the extension has reached our server once, nothing is limited. ### What does Pro include? (https://www.authenticator.sh/faq#pro) Unlimited accounts and cloud backup. Everything else works the same with Pro and without it. • Unlimited accounts: add as many as you need. • Cloud backup: an encrypted copy of your accounts on our server, so losing this computer does not mean losing your codes. Turn it on in Settings → "Backup & Restore" → "Cloud backup" → "Turn on". It is locked with a backup recovery code that never leaves your browser, so we cannot open it. On a new computer, enter your license key and then that code. If Pro ends, your copies can still be restored for 90 days. • Plans: a monthly or yearly subscription, or a one-time lifetime purchase. Which ones you see can differ while we find the right prices. • Paying happens on Stripe Checkout, in a new tab. Link, Stripe's payment service, is the seller of record: it handles receipts, taxes and questions about an order. • Pro turns on by itself in the browser you paid from. On another computer, open Settings → Pro → "I have a license key" and enter your key (2FA-XXXXX-XXXXX-XXXXX-XXXXX). One license works on up to 5 devices; a device that has not checked in for 60 days frees its place by itself. Need more devices? Write to support@authenticator.sh from the address you paid with, and we will raise the limit on your license. • To manage or cancel a subscription: Settings → Pro → "Manage subscription". If you cancel, Pro stays on until the end of the period you have paid for. ### I lost my license key (https://www.authenticator.sh/faq#lost-license-key) The key is in the email you received after paying, and it was shown on the page that opened once the payment went through. If you cannot find it, open the extension on the computer where you need it and go to Settings → Pro → "Get Pro" → "Restore a purchase". Enter the email address you paid with, and the key is sent there again. The same button is on the screen that appears when you reach the free limit. If no email arrives, write to support@authenticator.sh from the address you paid with, and we will send the key to you. Never send us a secret key or a backup file — we do not need them for this. ## The extension ### After installing 1. Pin the extension for quick access. Click the puzzle icon in the toolbar and pin Authenticator for easy access. 2. Click the extension icon to open Authenticator. Once pinned, click the Authenticator icon in the toolbar to open it anytime. 3. Add your first account. Open the extension. With no accounts yet, it asks where your codes are right now: pick your case and follow its steps. The "+" button appears once you have your first account. 4. Scan or enter a secret key. The QR code comes from the website you are protecting, not from the extension: turn on two-factor authentication in the site's security settings and pick the authenticator app option. Then scan its QR code straight from your screen, or paste the secret key it shows. 5. You're protected. Your 2FA codes will be generated automatically. Click any code to copy it to your clipboard. ### What it does - One right-click instead of your phone: right-click a two-factor code field and choose “Insert 2FA code”. The menu item appears on text fields. Nothing else changes. - One tap to the account you want: Sort accounts into groups like Work or Personal and filter the list in one tap. - Send someone a code, not your account: A link carries up to an hour of ready-made codes and never your secret key. Whoever you send it to opens it in any browser — nothing to install, no account to make. When the hour is up, there is nothing left in the link to show. The share button beside an account makes the link. Add a password and send it by another route — on its own, neither half opens anything. - Time-Synced Codes: Built-in time synchronization check ensures your codes are always accurate and valid. - QR Code Scanner: Scan QR codes directly from your screen. No need for a phone camera — just click and add. - Export & Import: Paste a whole list of otpauth:// links to move in, and export every account back out as the same plain links — the format other authenticators read. - Quick Search: Find your accounts instantly with built-in search. No scrolling through long lists. - Auto Backup: Automatic local backups keep the last 7 days, so a mistake or a browser reset doesn't cost you your accounts. - 20+ Languages: Available in English, Spanish, Chinese, Russian, Japanese, and many more languages. - Locked, even on a shared computer: Optionally lock your codes behind a password. They are encrypted on your device, and a recovery code means a forgotten password never costs you your accounts. ### How it compares Most authenticators live on your phone. This one lives in the browser, where you actually sign in. Checked against each product's own documentation, 2026-08. - 2FA Authenticator — Where it runs: Chrome; Puts the code in the login field: yes; Share a code, not your secret key: yes; Open source: yes; No account or phone number: yes; Export your codes: yes - Google Authenticator — Where it runs: Android, iOS; Puts the code in the login field: no; Share a code, not your secret key: no; Open source: no; No account or phone number: yes; Export your codes: yes - Authy — Where it runs: Android, iOS; Puts the code in the login field: no; Share a code, not your secret key: no; Open source: no; No account or phone number: no; Export your codes: no - Microsoft Authenticator — Where it runs: Android, iOS; Puts the code in the login field: no; Share a code, not your secret key: no; Open source: no; No account or phone number: yes; Export your codes: no - Proton Authenticator — Where it runs: Android, iOS, Windows, Mac, Linux; Puts the code in the login field: no; Share a code, not your secret key: no; Open source: yes; No account or phone number: yes; Export your codes: yes Longer comparisons: - Best authenticator extensions for Chrome: https://www.authenticator.sh/blog/best-authenticator-extensions-for-chrome - Authy desktop alternative: https://www.authenticator.sh/blog/authy-desktop-alternative - Google Authenticator for Chrome: https://www.authenticator.sh/blog/google-authenticator-for-chrome - Microsoft Authenticator alternative: https://www.authenticator.sh/blog/microsoft-authenticator-alternative - Authenticator app without a phone: https://www.authenticator.sh/blog/authenticator-app-without-phone - Move 2FA to a new phone: https://www.authenticator.sh/blog/move-2fa-to-new-phone - 2FA code not working: https://www.authenticator.sh/blog/2fa-code-not-working ## Setting up two-factor authentication on a service All guides: https://www.authenticator.sh/2fa ### Adding any service to the extension The same steps for every service — [service] below is whichever one is being set up. 1. Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away. 2. Leave the [service] page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”. 3. The account appears in the list with a six-digit code that changes every 30 seconds. Rename it if you like — the name is only for you. 4. Go back to [service] and type the current code into the confirmation field. If it is about to expire, wait for the next one. 5. [service] confirms that two-factor authentication is on. From now on it will ask for a code when you sign in — click the extension icon and copy it. No QR code, or it will not scan? Look for the option to enter a key manually on [service]’s setup screen, copy the key, and add it in the extension with “Add Account” → “Manual” → “Secret Key”. The code is not accepted? Most often the QR code changed: the website makes a new one each time its setup page is reloaded or opened again, so the account you added first no longer matches. Start the setup again, add the QR code that is on the screen now and type its code in straight away. Two entries for the same website? Use the newest. Other reasons: why codes are refused (https://www.authenticator.sh/faq#codes-not-working). Typed the key in by hand? Paste it into the TOTP code generator (https://www.authenticator.sh/generator) and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again. ### Your service is not on the list? It almost certainly works the same way. Any site that offers an “authenticator app” option uses the same standard codes: turn it on in the site’s security settings, scan the QR code from the screen with the extension, and type the six-digit code back. If the site shows a key instead of a QR code — here is where to find it: https://www.authenticator.sh/faq#secret-key. ### Roblox (https://www.authenticator.sh/2fa/roblox — steps checked on 2026-09-24; Roblox's own instructions: https://en.help.roblox.com/hc/en-us/articles/212459863-Add-2-Step-Verification-to-Your-Account) Roblox 2-Step Verification works with any authenticator app — including one that runs in your browser. Turn it on in Settings → Security, scan the QR code straight from the screen with the Authenticator extension, and you never need a phone to sign in. Roblox needs a verified email address before any 2-Step Verification method can be turned on, and only one method can be on at a time — turning on the authenticator replaces email codes. Turn on 2-Step Verification in Roblox: 1. Sign in at roblox.com on your computer. 2. Click the gear icon in the upper right corner and choose “Settings”. 3. Open the “Security” tab. 4. Turn on the authenticator app option under 2-Step Verification and follow the instructions on the screen. 5. When Roblox shows a QR code, leave that page open and add it to the extension as described below. Generate your Roblox recovery codes: In the same “Security” tab, find recovery codes and click “Generate” — Roblox asks for your password. The codes are shown only once, each works once, and generating a new set cancels the old one. Save them somewhere other than this computer. Roblox warns that without a second way to verify — recovery codes, a phone number or a passkey — you may be unable to get the account back if you lose your authenticator. Q: Can I use a Roblox authenticator without a phone? A: Yes. Roblox only needs an app that produces standard six-digit codes; it does not care what device runs it. The Authenticator extension produces them in Chrome on your computer and can read the QR code directly from the Roblox page. Q: Which authenticator app works with Roblox? A: Any app that supports standard time-based codes (TOTP): Google Authenticator, Microsoft Authenticator, Authy, 2FAS — or a browser extension like this one. The QR code Roblox shows works with all of them. Q: What if I lose access to my authenticator? A: Sign in with one of your recovery codes, then turn the authenticator off and on again to set it up anew. Without recovery codes, contact Roblox Support — and turn on the extension’s password protection and keep its automatic backups so a reinstall does not cost you the account. Q: Why does Roblox say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set 2-Step Verification up again. ### Discord (https://www.authenticator.sh/2fa/discord — steps checked on 2026-09-24; Discord's own instructions: https://support.discord.com/hc/en-us/articles/26304482627095-Using-an-Authenticator-App-on-Discord) Discord 2FA works with any authenticator app, including one in your browser. Open User Settings → My Account → Enable Authenticator App, scan the QR code from the screen with the Authenticator extension, and confirm with the six-digit code. Turn on the authenticator app in Discord: 1. Open Discord in the desktop app or at discord.com in your browser. 2. Click the cogwheel next to your username to open “User Settings”. 3. Go to “My Account” and find the “Password and Authentication” section. 4. Click “Enable Authenticator App” and confirm your password if Discord asks for it. 5. Discord shows a QR code. Leave it on the screen and add it to the extension as described below — then type the code into “Login with your code” and click “Activate”. Save your Discord backup codes: Right after activation Discord offers backup codes — eight-digit, single-use codes it downloads as discord_backup_codes.txt. Keep that file somewhere other than this computer. You can see them again, and which ones are used, under User Settings → My Account → “View Backup Codes”. Discord can also add SMS as a backup, but only after the authenticator app is on. Q: Can I use Discord 2FA without a phone? A: Yes. Discord accepts codes from any standard authenticator app, and the Authenticator extension generates them in Chrome. It can read the QR code straight off the Discord settings page, in the browser or from a screenshot of the desktop app. Q: I lost my authenticator. Can Discord support turn 2FA off? A: No — Discord states that its support team cannot remove 2FA or issue new backup codes. At the login prompt choose “Verify with something else” and use a backup code or an SMS code if you set one up. That is why saving the backup codes, and backing up the extension, matters. Q: Why is my Discord code invalid? A: Check the computer clock first: codes are based on the current time and a clock that is off by more than about 30 seconds produces codes Discord refuses. If the clock is fine, remove the account from the extension, turn the authenticator off in Discord with a backup code, and set it up again. Q: Does the Discord desktop app work with a browser authenticator? A: Yes. The desktop app only asks for the six-digit code — copy it from the extension’s icon in Chrome and paste it into the app. ### Epic Games (https://www.authenticator.sh/2fa/epic-games — steps checked on 2026-09-24; Epic Games's own instructions: https://www.epicgames.com/help/en-US/c-Category_EpicAccount/c-AccountSecurity/two-factor-authentication-2fa-and-how-to-enable-it-a000084651) Epic Games supports any third-party authenticator app, including one in your browser. Go to Account → Password & Security → Third-Party Authenticator App, add the account to the Authenticator extension, and confirm with the six-digit code. Turn on two-factor authentication at Epic Games: 1. Sign in at epicgames.com on your computer and open your “Account” page. 2. Choose the “Password & Security” tab. 3. Under “Two-Factor Authentication”, choose “Third-Party Authenticator App”. 4. Epic shows the setup for the app. Leave it on the screen and add it to the extension as described below. 5. Enter the code the extension shows into Epic’s field to finish — Epic confirms that 2FA is on. Get your Epic Games backup codes: In “Password & Security”, the authenticator section has a “Get Backup Codes” button. Download or write the codes down and keep them away from this computer. If you ever lose the authenticator, the sign-in prompt has “Try another way”, where a backup code gets you in. Q: Do I need the Epic Games app or a phone for 2FA? A: No. Epic offers its own authenticator in the Epic Games app, but also accepts any third-party authenticator app. The Authenticator extension generates the same standard codes in Chrome on your computer. Q: How do I get the Boogie Down emote? A: Epic grants it for turning on two-factor authentication on your account. Turn on the authenticator app as described above, then sign in to Fortnite — Epic’s help pages list it as the 2FA reward. Q: Why do I need 2FA to gift in Fortnite? A: Epic requires two-factor authentication to send gifts, to make it harder for someone with a stolen password to spend your V-Bucks on themselves. Once the authenticator is on, gifting becomes available. Q: What if I get locked out of my Epic account? A: At the 2FA prompt choose “Try another way” and enter a backup code. Without backup codes, Epic’s account recovery process through support is the only way back — which is why saving them takes a minute and saves days. ### GitHub (https://www.authenticator.sh/2fa/github — steps checked on 2026-09-24; GitHub's own instructions: https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication) GitHub accepts any TOTP authenticator app, including one in your browser. Go to Settings → Password and authentication → Enable two-factor authentication, scan the QR code from the screen with the Authenticator extension, and verify with the six-digit code. Turn on two-factor authentication on GitHub: 1. Click your profile picture in the upper right corner and choose “Settings”. 2. In the “Access” section of the sidebar, click “Password and authentication”. 3. Click “Enable two-factor authentication”. 4. GitHub shows a QR code. Leave it on the screen and add it to the extension as described below — or click “setup key” to copy the key for manual entry. 5. Type the code from the extension under “Verify the code from the app” and continue. Download your 16 GitHub recovery codes: The next step in setup is “Save your recovery codes”: click “Download”, keep github-recovery-codes.txt somewhere other than this computer, and confirm with “I have saved my recovery codes”. You can view them again, or generate a new set (which cancels the old one), under Password and authentication → Recovery codes. GitHub also asks you to confirm 2FA still works during a 28-day check-up after you turn it on. Q: Is 2FA required on GitHub? A: For users who contribute code, yes. GitHub notifies you, gives you an enrollment period to turn it on, and after a short grace period blocks access until 2FA is enabled. Q: Can I use a browser extension instead of a phone app for GitHub? A: Yes. GitHub accepts any TOTP app. The Authenticator extension keeps the codes in Chrome, on your device only, and can be locked behind a password. For the most sensitive accounts add a passkey or security key to GitHub as well — GitHub supports several methods at once. Q: What if I lose my authenticator for GitHub? A: At the 2FA prompt, open “More options” and use a recovery code, a passkey, a security key or fallback SMS if you set one up. Without any of them, GitHub’s account recovery request takes several business days, and GitHub Support cannot restore access without proof you own the account. Q: Where is the GitHub setup key? A: On the QR code step, click “setup key”. GitHub shows the key as text — copy it into the extension with “Add Account” → “Manual” → “Secret Key”. ### Instagram (https://www.authenticator.sh/2fa/instagram — steps checked on 2026-09-24; Instagram's own instructions: https://help.instagram.com/1582474155197965/) Instagram two-factor authentication works with any authentication app, including one in your browser. On instagram.com open Settings → Accounts Center → Password and security → Two-factor authentication, choose “Authentication app”, and add the account to the Authenticator extension. Turn on two-factor authentication on Instagram: 1. Sign in at instagram.com on your computer and click “More” in the bottom left. 2. Choose “Settings”, then “Accounts Center”. 3. Open “Password and security” → “Two-factor authentication” and select your Instagram account. 4. Choose “Authentication app” and click “Next”. 5. Add the key or QR code Instagram shows to the extension as described below, then enter the confirmation code on Instagram. Save your Instagram backup codes: In Accounts Center → Password and security → Two-factor authentication, select your account and open “Additional methods” → “Backup codes”. Write them down or save them away from this computer — a backup code signs you in when the authentication app is not available. Q: Can I use an Instagram authentication app on my computer? A: Yes. Instagram needs an app that produces standard six-digit codes, and the Authenticator extension produces them in Chrome. Setting it up on the computer also means you can sign in on the web without reaching for your phone. Q: Is an authentication app better than SMS for Instagram? A: Yes. SMS codes can be intercepted by someone who takes over your phone number, and they do not arrive when you are abroad or offline. An authentication app generates codes on your device with no network at all. Q: What if I lose access to my authentication app? A: Sign in with a backup code or another method you set up, then set the authentication app up again. Keeping the extension’s automatic backups on, and exporting a password-protected backup, means a reinstall does not lose the account. Q: Can I use the same authentication app on my phone too? A: Yes. Meta allows more than one device. The simplest way is during setup: scan the same QR code with your phone app as well, before you confirm — both will show the same codes. Later you can export the account from the extension as an otpauth:// link in Settings → Export. ### Facebook (https://www.authenticator.sh/2fa/facebook — steps checked on 2026-09-24; Facebook's own instructions: https://www.facebook.com/help/358336074294704) Facebook two-factor authentication works with any authentication app, including one in your browser. Open Settings and privacy → Settings → Accounts Center → Password and security → Two-factor authentication, choose “Authentication app”, and add the account to the Authenticator extension. Turn on two-factor authentication on Facebook: 1. Sign in at facebook.com on your computer and click your profile picture in the top right. 2. Choose “Settings and privacy”, then “Settings”. 3. Click “Accounts Center”, then “Password and security”. 4. Open “Two-factor authentication”, select your Facebook account and choose “Authentication app”. 5. Add the QR code or key Facebook shows to the extension as described below, click “Next”, and enter the code from the extension. Get your Facebook recovery codes: In Accounts Center → Password and security → Two-factor authentication, select your account, click “Additional methods” and then “Recovery codes”. Facebook gives you 10 codes, each works once, and “Get new codes” replaces the whole set. Write them down or save them away from this computer — a recovery code signs you in when the authentication app is not available. Q: Can I use a Facebook authenticator app on my computer? A: Yes. Facebook needs an app that produces standard six-digit codes, and the Authenticator extension produces them in Chrome. It can read the QR code straight off the Facebook settings page. Q: Is Code Generator the same as an authentication app? A: No. Code Generator lives inside the Facebook mobile app and only works on the phone where it is installed. An authentication app is separate from Facebook, so a lost phone or a signed-out Facebook app does not take your codes with it. Q: What if I lose access to my authentication app? A: At the code prompt choose “Try another way” and use a recovery code, a security key or text message codes if you added them. Otherwise Facebook may let you confirm a sign-in from a device it already recognizes. Keeping the extension’s automatic backups on means a reinstall does not lose the account. Q: Why does Facebook say my code is wrong? A: Usually the computer clock is off. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from a QR code that was replaced — set up the authentication app again and add the new one. ### X (Twitter) (https://www.authenticator.sh/2fa/x-twitter — steps checked on 2026-09-24; X (Twitter)'s own instructions: https://help.x.com/en/managing-your-account/two-factor-authentication) X two-factor authentication works with any authentication app, including one in your browser — and it is free, while text message codes are limited to Premium subscribers. Open Settings and privacy → Security and account access → Security → Two-factor authentication, choose “Authentication app” and scan the QR code with the Authenticator extension. Turn on two-factor authentication on X: 1. Sign in at x.com on your computer and click “More” in the left menu. 2. Choose “Settings and privacy”, then “Security and account access” → “Security”. 3. Click “Two-factor authentication” and check “Authentication app”. 4. Click “Get started” and confirm your password. X shows a QR code — leave it on the screen and add it to the extension as described below. 5. Enter the code from the extension to confirm. X confirms that two-factor authentication is on. Save your X backup code: Right after setup X offers “Get backup code”. Copy it and keep it away from this computer — it is the way in if you lose the authentication app. You can get a new one later under Security → Two-factor authentication → “Backup codes”; X keeps up to five active codes, and they have to be used in the order they were generated. Q: Is two-factor authentication on X free? A: With an authentication app or a security key, yes. Only text message codes require X Premium. The Authenticator extension is free to use as well: a new installation may have a limit on free accounts, which Pro removes. Q: Can I use X 2FA without a phone? A: Yes. X accepts codes from any standard authentication app, and the Authenticator extension generates them in Chrome on your computer. It reads the QR code straight off the X settings page. Q: What if I lose access to my authentication app? A: At the code prompt, click the link to use a backup code. Without one, X support may not be able to restore access — which is why saving the backup code, and keeping the extension’s automatic backups on, matters. Q: Why does X say my code is wrong? A: Check the computer clock first: a clock that is off by more than about 30 seconds produces codes X refuses. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension and set 2FA up again. ### Google (https://www.authenticator.sh/2fa/google — steps checked on 2026-09-25; Google's own instructions: https://support.google.com/accounts/answer/185839?hl=en&co=GENIE.Platform%3DDesktop) Google 2-Step Verification works with Google Authenticator or any other app that creates one-time verification codes — including one in your browser. Open your Google Account → Security & sign-in → 2-Step Verification, set up the authenticator, and scan the QR code straight from the screen with the Authenticator extension. The authenticator is a second step inside 2-Step Verification, so it is set up from the 2-Step Verification page. If you use an account through your work, school or another group, your administrator may control these settings. Add an authenticator to Google 2-Step Verification: 1. Sign in to your Google Account at myaccount.google.com on your computer. 2. Click “Security & sign-in”. 3. Under “How you sign in to Google”, click “2-Step Verification” — or “Turn on 2-Step Verification” if it is still off, and follow the on-screen steps. 4. On the 2-Step Verification page, find the authenticator option and click “Set up authenticator”. 5. Google shows a QR code. Leave it on the screen and add it to the extension as described below — then click “Next”, enter the code from the extension and click “Verify”. Get your Google backup codes: On the same 2-Step Verification page, open “Backup codes” and click “Get backup codes”. Google gives you a set of 10 eight-digit codes; each works once, and “Refresh” creates a new set and cancels the old one. Click “Download Codes” or “Print” and keep them somewhere other than this computer — at sign-in, “Try another way” → “Enter one of your 8-digit backup codes” gets you in without the authenticator. Q: Do I need the Google Authenticator app for my Google Account? A: No. Google accepts Google Authenticator or any other app that creates one-time verification codes. The Authenticator extension generates the same standard codes in Chrome on your computer and reads the QR code straight off the Google settings page. Q: Why doesn’t Google ask for my authenticator code? A: Google picks the second step it thinks is best — often a prompt on your phone — so click “Try another way” and choose the authenticator code. Google also says a newly added authenticator can take up to 7 days to appear as a sign-in option; that delay protects you if someone else added it. Q: What if I lose access to my authenticator? A: Sign in with a backup code, a Google prompt on another signed-in phone, a passkey, a security key, or from a computer where you checked “Don’t ask again on this computer”, then set the authenticator up again. With no second step left, Google’s account recovery can take 3–5 business days — so keep the backup codes and the extension’s automatic backups. Q: Why does Google say my code is wrong? A: Google’s own checklist: the code was entered before it expired, it belongs to the right Google Account, and the device’s time is synced and correct for your time zone. On a computer the clock is the usual cause — turn on automatic date and time and try the next code. ### Microsoft (https://www.authenticator.sh/2fa/microsoft — steps checked on 2026-09-25; Microsoft's own instructions: https://support.microsoft.com/en-us/account-billing/set-up-an-authenticator-app-as-a-two-step-verification-method-2db39828-15e1-4614-b825-6e2b524e7c95) Your Microsoft account works with any authenticator app, not only Microsoft Authenticator — including one in your browser. Open account.microsoft.com/security → Manage how I sign in → Add a new way to sign in or verify → Use an app, choose “Set up a different Authenticator app”, and scan the QR code with the Authenticator extension. With two-step verification on, you always need two forms of identification — lose one and your password alone will not get you back in, and regaining access can take 30 days. Microsoft recommends having three pieces of security info on the account, such as a backup email address, before you turn it on. Turn on two-step verification for your Microsoft account: 1. Sign in at account.microsoft.com/security on your computer. 2. Click “Manage how I sign in” to see the ways you prove who you are. 3. Click “Add a new way to sign in or verify” and choose “Use an app”. 4. Microsoft offers its own Microsoft Authenticator. Instead, click “Set up a different Authenticator app” and then “Next”. 5. Microsoft shows a QR code. Leave it on the screen and add it to the extension as described below — or click “I can't scan the bar code” to see a code for manual entry — then enter the code from the extension. 6. Back on “Manage how I sign in”, under “Additional security” → “Two-step verification”, choose “Turn on” and follow the instructions on the screen. Generate your Microsoft recovery code: On the same “Manage how I sign in” page, scroll to “Recovery code” and click “Generate a new code”. There is only ever one: generating a new code cancels the previous one, and Microsoft cannot show or download an existing code again. Print it and keep it away from any device you sign in with. If you lose your other methods, the sign-in page asks “Do you have an account recovery code?” — though with two-step verification on, changes can take 30 days to take effect. Q: Do I have to use Microsoft Authenticator? A: No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page. Q: What if I lose access to my authenticator? A: Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups. Q: An app says my password is incorrect after I turned on two-step verification. A: Some apps and devices — the mail apps on some phones, or an Xbox 360 — cannot ask for a code. For those, create an app password in the account’s additional security options and use it instead of your normal password. Q: Why can’t I add a phone number for text message codes? A: Microsoft is phasing out SMS as a sign-in and recovery method for personal accounts, so the option may not appear at all. An authenticator app, a passkey or a backup email address are what it offers instead. ### Amazon (https://www.authenticator.sh/2fa/amazon — steps checked on 2026-09-25; Amazon's own instructions: https://www.amazon.com/gp/help/customer/display.html?nodeId=G3PWZPU52FKN7PW4) Amazon Two-Step Verification works with any authenticator app, including one in your browser. Open Your Account → Login & security, turn on 2-Step Verification, choose “Authenticator App” and scan the barcode from the screen with the Authenticator extension. Amazon will not turn on Two-Step Verification without a backup method. Have a phone number that can receive text messages ready, or a second authenticator app, before you start. Turn on Two-Step Verification at Amazon: 1. Sign in at amazon.com on your computer, open “Account & Lists” and choose “Account”. 2. Select “Login & security”. 3. Click “Turn on” next to 2-Step Verification. 4. Choose “Authenticator App”. Amazon shows a barcode — leave it on the screen and add it to the extension as described below, then enter the code and click “Verify code and continue”. 5. Add the backup method Amazon asks for — a phone number or another authenticator app — and verify it. 6. On the “Almost done…” page, choose whether this browser should ask for codes, then click “Got it. Turn on Two-Step Verification”. Keep a backup method for Amazon: Amazon does not hand out backup codes: its fallback is the backup method you add during setup — a phone number or a second authenticator app. You can add more, or change them, later under Login & security → 2-Step Verification. If you lose the authenticator, Amazon asks you to sign in with a backup method or from a trusted device first; only after that does its “Two-Step Verification Account Recovery” process come in. Q: Can I use Amazon Two-Step Verification without a phone app? A: Yes. Amazon accepts codes from any standard authenticator app, and the Authenticator extension generates them in Chrome on your computer. It reads the barcode straight off the Amazon setup page. Amazon still needs a backup method, which can be a phone number or a second authenticator app. Q: Do I have to enter a code every time I shop on Amazon? A: No. When you sign in with a code, check “Do not require codes on this device”, and that computer will only ask for your password from then on. Leave it unchecked on shared or public computers. Q: My Kindle or another device does not ask for a code. How do I sign in? A: Use Amazon’s Alternate Sign-in: enter your email and password and submit; if you get an error, add the current code from the extension to the end of your password and submit again. For example, the password “amazon123” with the code 456789 becomes “amazon123456789”. Q: What if I lose access to my authenticator? A: Sign in with your backup method or from a trusted device, then set up the authenticator again under Login & security. If neither works, choose “Didn’t Receive the Code” at the code prompt and then “Two-Step Verification Account Recovery”. Keeping the extension’s automatic backups on means a reinstall does not cost you the account. ### PayPal (https://www.authenticator.sh/2fa/paypal — steps checked on 2026-09-25; PayPal's own instructions: https://www.paypal.com/us/cshelp/article/what-is-2-step-verification-help167) PayPal 2-step verification works with any authenticator app, including one in your browser. On paypal.com open Settings → Security → 2-step verification, choose “Use an authenticator app”, and scan the QR code from the screen with the Authenticator extension. PayPal lets you set up 2-step verification only in a web browser, not in the PayPal app — which makes a computer the right place to do it. Turn on 2-step verification at PayPal: 1. Log in at paypal.com in your browser on the computer. 2. Click the “Settings” icon next to “Log out”. 3. Click “Security” near the top of the page. 4. Click “Set Up” to the right of “2-step verification”, choose “Use an authenticator app” and click “Set it Up”. 5. Follow the steps on the screen. When PayPal shows a QR code, leave it on the screen and add it to the extension as described below, then enter the code from the extension to finish. Keep a way back into PayPal: PayPal’s help pages do not describe backup codes for 2-step verification, so plan your own way back before you need it. The simplest is during setup: scan the same QR code with an authenticator app on your phone as well, before you confirm — both will show the same codes. Keep the extension’s automatic backups on, and keep your phone number and email address up to date in your PayPal profile, which PayPal uses to send one-time passcodes when it needs to confirm it is you. Q: Can I set up PayPal 2-step verification in the PayPal app? A: No. PayPal says 2-step verification can only be set up through a web browser, not the PayPal app. Log in at paypal.com on your computer — the Authenticator extension can read the QR code straight off that page. Q: Can I still use text messages for PayPal 2-step verification? A: PayPal’s help describes setting it up with an authenticator app, and notes that customers who have text-message 2-step verification and turn it off will not be able to turn it on again. An authenticator app also works with no signal and cannot be intercepted with your phone number. Q: What if I lose access to my authenticator? A: Use the second copy you set up on your phone, or restore the extension from its backups. If neither is available, click “Contact Us” at the bottom of any PayPal page. Once you are back in, turn 2-step verification off and on again under Settings → Security to set up a new authenticator. Q: Why does PayPal say my code is wrong? A: Usually the computer clock is off. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set 2-step verification up again. ### Coinbase (https://www.authenticator.sh/2fa/coinbase — steps checked on 2026-09-25; Coinbase's own instructions: https://help.coinbase.com/en/coinbase/getting-started/verify-my-account/how-do-i-set-up-2-factor-authentication) Coinbase supports all authenticator apps — including one that runs in your browser. Open the 2-step verification settings, click “Set up” next to “Authenticator app”, scan the QR code from the screen with the Authenticator extension, and confirm with the six-digit code. 2-step verification is already on for every Coinbase account, usually with text message codes. Adding an authenticator app does not lock you out of the others: Coinbase lets you keep several methods, turn each on or off, and pick another one at sign-in with “Try another way”. Turn on the authenticator app at Coinbase: 1. Sign in at coinbase.com on your computer. 2. Open the 2-step verification settings page at accounts.coinbase.com/security/settings. 3. In “Available methods”, click “Set up” next to “Authenticator app”. 4. Follow the prompts. When Coinbase shows the QR code, leave it on the screen and add it to the extension as described below. 5. Enter the code from the extension to finish. You can turn methods on or off later on the same page. Give Coinbase a second way in: Coinbase’s safety net is a second method rather than a list of codes: it recommends setting up more than one, so that if one fails you can choose “Try another way” at sign-in. Add a passkey or a security key next to the authenticator, and consider trusted contacts — two to five people you know who can approve an account recovery request, usable 24 hours after setup. If the authenticator is your only method and you lose it, recovery goes through ID verification, which takes up to 24 hours and may stop you from sending funds for another 24. Q: Can I use a Coinbase authenticator on my computer instead of a phone? A: Yes. Coinbase supports all authenticator apps; its instructions mention a phone only because that is where most people keep one. The codes are standard time-based codes (TOTP), so the Authenticator extension generates the same ones in Chrome and can read the QR code straight off the Coinbase page. Q: Is an authenticator app better than SMS on Coinbase? A: Yes. Coinbase calls text messages its least secure method: someone who moves your phone number to their own SIM card receives your codes. An authenticator app is tied to your device, not your number. A security key or passkey is stronger still, and Coinbase recommends one for the best protection. Q: What if I lose my authenticator for Coinbase? A: At sign-in choose “Try another way” and use another method you set up. If the authenticator was your only one, start account recovery at login.coinbase.com/recovery: you upload your ID or ask your trusted contacts to approve, it takes up to 24 hours, and sending funds may be blocked for 24 hours after. Keeping the extension’s automatic backups on means a reinstall does not send you there. Q: Why does Coinbase say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator app up again. ### Binance (https://www.authenticator.sh/2fa/binance — steps checked on 2026-09-25; Binance's own instructions: https://www.binance.com/en/support/faq/how-to-enable-google-authentication-2fa-and-frequently-asked-questions-115000433432) Binance’s “Authenticator App” option uses the same standard codes as Google Authenticator, so it works with an authenticator in your browser too — you do not need Binance’s own Binance Authenticator app. Go to Account → Security → Authenticator App, scan the QR code from the screen with the Authenticator extension, and verify with the six-digit code. Binance warns not to click “Next” until the authenticator has added the account. With the extension that takes one click — just do it before you move on. Turn on the authenticator app on Binance: 1. Sign in at binance.com on your computer, hover over the profile icon and click “Account”. 2. Go to “Security” and click “Manage” next to “Authenticator App”. 3. Click “Enable Authenticator App”. 4. Binance shows a QR code and a setup key. Leave them on the screen and add the account to the extension as described below — before you click “Next”. 5. Click “Next” and enter the six-digit code from the extension. Binance confirms that the authenticator is enabled. Keep the Binance setup key safe: Binance’s help pages describe no backup codes for the authenticator. The setup key shown next to the QR code is what the codes are made from: kept on paper, away from this computer and as private as a password, it lets you add the account to any authenticator again. If you lose the authenticator anyway, the sign-in screen has “Security verification unavailable?”, where you pick the lost method and confirm the reset with the verification methods you still have. After a reset or a change of authenticator, Binance disables withdrawals, P2P selling, internal transfers and payment services for up to 48 hours. Q: Do I need the Binance Authenticator app? A: No. Binance promotes its own Binance Authenticator app, but its “Authenticator App” option is the standard kind — Binance’s own guide sets it up with Google Authenticator. Any app that produces standard time-based codes (TOTP) works the same way, including the Authenticator extension in Chrome, which reads the QR code straight off the Binance page. Q: Why are my Binance withdrawals disabled after changing 2FA? A: It is a safety hold. After you change or reset your authenticator, Binance disables withdrawals, internal transfers and P2P transactions for up to 48 hours, so someone who took over the account cannot empty it straight away. Set the authenticator up well before you need to move funds. Q: What if I lose my authenticator for Binance? A: At the security verification step, choose the authenticator and click “Security verification unavailable?”, tick it on the Reset Security Verification page and confirm with your other methods. Some requests go under review, which can take up to 24 hours; if you have also forgotten your password, contact Binance support. Keeping the extension’s automatic backups on means a reinstall does not start this process. Q: Why does Binance say “verification code error”? A: Binance’s own first suggestion is to synchronize the time: the codes are calculated from the clock, and a computer clock that is off by more than about 30 seconds produces codes Binance refuses. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension and set the authenticator up again. ### Reddit (https://www.authenticator.sh/2fa/reddit — steps checked on 2026-09-25; Reddit's own instructions: https://support.reddithelp.com/hc/en-us/articles/360043470031-What-is-two-factor-authentication-and-how-do-I-set-it-up) Reddit two-factor authentication works with any authenticator app, including one in your browser — and Reddit only lets you turn it on from a computer anyway. Open Settings → Account authorization → Two-factor authentication on reddit.com, add the account to the Authenticator extension, and confirm with the six-digit code. Reddit’s two-factor authentication covers only logins with a Reddit username and password. If you log in with Google or Apple, Reddit asks you to set up two-factor authentication with them instead. Turn on two-factor authentication on Reddit: 1. Log in at reddit.com in a web browser on your computer — Reddit does not let you turn two-factor authentication on in the app. 2. Click your username in the top right of the screen and select “Settings”. 3. Under “Account authorization”, click “Two-factor authentication”. 4. Enter your password and click “Confirm”. 5. Follow the instructions on the screen: add the QR code or key Reddit shows to the extension as described below, leaving the page open, then enter the six-digit code. Reddit may ask you to log out and back in afterwards. Get your ten Reddit backup codes: In Settings, under “Account authorization”, click “Access your backup codes” and enter your password. Reddit generates ten backup codes, each usable once. Write them down or keep them in a password manager, away from this computer. You can generate a new set later — it replaces the old one — but only while you are logged in, so save them before you need them. Q: Can I use Reddit two-factor authentication without a phone? A: Yes. Reddit asks for a six-digit code from an authenticator app and does not care what device runs it. The Authenticator extension generates the codes in Chrome on the same computer where Reddit has you set it up. Q: I log in to Reddit with Google or Apple. Does this apply to me? A: No. Reddit’s two-factor authentication only protects logins with a Reddit username and password. If you log in with your Google account or Apple ID, turn on two-factor authentication for that account instead. Q: What if I lose access to my authenticator? A: Log in with one of your backup codes. If you are still logged in to Reddit somewhere else, go to Settings and generate new backup codes, or connect your Google account or Apple ID so you have another way to log in. Keeping the extension’s automatic backups on means a reinstall does not cost you the account. Q: A third-party Reddit app does not ask for my code. How do I log in? A: Apps that use Reddit’s standard login ask for the six-digit code themselves. For those that do not, Reddit says to type your password and the current code together in the password field, separated by a colon: password:123456. ### Twitch (https://www.authenticator.sh/2fa/twitch — steps checked on 2026-09-25; Twitch's own instructions: https://help.twitch.tv/s/article/two-factor-authentication) Twitch accepts any app that supports standard time-based codes, including one in your browser. Open Settings → Security and Privacy → Set Up Two-Factor Authentication on twitch.tv, verify your phone number by text message, then scan the QR code from the screen with the Authenticator extension and confirm with the six-digit code. Twitch needs a verified email address, and 2FA can only be turned on at twitch.tv in a browser. Twitch also always verifies a mobile phone number by text message first — VoIP numbers and landlines are not supported — and only then offers the authenticator app. Turning 2FA on signs you out of Twitch on every other device. Turn on two-factor authentication on Twitch: 1. Sign in at twitch.tv on your computer, click your profile picture in the top right corner and select “Settings”. 2. Open the “Security and Privacy” tab, click “Set Up Two-Factor Authentication”, then “Enable 2FA”. 3. Enter your mobile phone number and click “Continue”, then enter the seven-digit code Twitch texts you and click “Continue”. 4. Twitch shows a QR code for an authenticator app. Leave it on the screen and add it to the extension as described below. 5. Enter the six-digit code from the extension and click “Submit”. Twitch confirms that two-factor authentication is on. Keep a way back into Twitch: Twitch keeps your phone number as a text message backup, and suggests scanning the same QR code with more than one app or device during setup — so a lost authenticator is not a lost account. If you lose both the authenticator and the phone number, you are locked out until you change the number through Authy’s Phone Change Form, which Authy processes in 24–48 business hours and Twitch Support cannot speed up. Keeping the extension’s automatic backups on means a reinstall does not put you in that queue. Q: Do I need a phone for Twitch 2FA? A: You need a mobile phone number: Twitch always verifies one by text message before it offers an authenticator app. After that, the codes you sign in with can come from the Authenticator extension in Chrome — no phone app needed. Q: Why does Twitch mention Authy if I use another app? A: Authy runs the system behind Twitch’s 2FA. Twitch creates an Authy account linked to your phone number for everyone who turns 2FA on, whichever app generates the codes. You do not need the Authy app — it matters only if you ever have to change the phone number. Q: Do I need 2FA to stream on Twitch? A: Yes. Twitch says two-factor authentication is not required to watch, but it is required to start streaming, and to begin Affiliate onboarding — every Affiliate and Partner must have it on. Q: How do I get the Twitch 2FA emotes? A: Once 2FA is on with both your phone number and an authenticator app, six exclusive emotes appear in the “Unlocked” section of the chat emote picker. They disappear whenever 2FA is turned off — including while you switch from one authenticator app to another — and come back when setup is complete. ### PlayStation (https://www.authenticator.sh/2fa/playstation — steps checked on 2026-09-25; PlayStation's own instructions: https://www.playstation.com/en-us/support/account/2sv-login/) PlayStation 2-step verification works with any authenticator app, including one in your browser. In Account Management open Security → 2-step Verification Status → Edit, choose “Authenticator App”, scan the QR code from the screen with the Authenticator extension, and activate it with the code the extension shows. Turn on 2-step verification for PlayStation: 1. Sign in to Account Management at playstation.com on your computer. 2. Select “Security”. 3. Next to “2-step Verification Status”, select “Edit”. 4. Choose “Authenticator App” as the verification method. 5. PlayStation shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the code from the extension and select “Activate”. Record your PlayStation backup codes: The last step of setup is “Record your Backup Codes”. PlayStation gives you 10, and each works once. Write them down or save them away from this computer. You can see them again under Account Management → Security → “Backup Codes” — but only while you can still sign in, so do it now rather than later. To get a fresh set, turn 2-step verification off and on again. Q: Can I use PlayStation 2-step verification without a phone? A: Yes. PlayStation accepts codes from any authenticator app, and the Authenticator extension generates them in Chrome on your computer. It reads the QR code straight off the Account Management page, so you never need a console or a phone for setup. Q: Which authenticator app works with PlayStation? A: Sony names Authy, Google Authenticator and Microsoft Authenticator as examples, but any app that supports standard time-based codes works — including a browser extension like this one. If the QR code will not scan, PlayStation also shows the key as an alphanumeric code you can paste in. Q: What if I lose access to my authenticator? A: On the sign-in screen click “Trouble Receiving Code?” → “Sign In Using a Backup Code” and enter one of your 10 backup codes. Once in, turn 2-step verification off and on again to set up the authenticator anew. Without backup codes you have to contact PlayStation Support through its Online Assistant — and turning on the extension’s password protection and automatic backups keeps a reinstall from putting you there. Q: Why does PlayStation say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension, turn 2-step verification off and on again, and add the new one. ### Nintendo (https://www.authenticator.sh/2fa/nintendo — steps checked on 2026-09-25; Nintendo's own instructions: https://en-americas-support.nintendo.com/app/answers/detail/a_id/27496/~/how-to-set-up-2-step-verification-for-a-nintendo-account) Nintendo Account 2-Step Verification works with Google Authenticator or any similar app — including one in your browser. On the Nintendo Account website open Sign-in and security settings → 2-Step Verification → Edit, scan the QR code from the screen with the Authenticator extension, and submit the six-digit code. 2-Step Verification is set up on the Nintendo Account website, and it is not available for child accounts whose age makes them subject to parental consent laws. Nintendo may ask you to confirm it is you first — with your password, a passkey, or a code sent to your email address. Turn on 2-Step Verification for your Nintendo Account: 1. Go to accounts.nintendo.com on your computer and sign in to your Nintendo Account. 2. Select “Sign-in and security settings”. 3. Scroll to “2-Step Verification”, select “Edit”, then click “2-Step Verification setup”. 4. Confirm your identity if Nintendo asks — with your password, a passkey or an email code. 5. Nintendo shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the code from the extension in the “Verification code” field and select “Submit”. Save your Nintendo backup codes: As soon as the code is accepted, Nintendo shows a list of 10 backup codes. Click “Copy” and paste them somewhere other than this computer — Nintendo requires a backup code to sign in when your authenticator is not available, and each works once. You can see them again, or generate new ones, under Sign-in and security settings → 2-Step Verification → “Review backup codes”. Q: Do I have to use Google Authenticator for my Nintendo Account? A: No. Nintendo’s instructions name Google Authenticator, but Nintendo also accepts any similar authentication app — the QR code is the standard kind. The Authenticator extension reads it straight off the Nintendo Account page and produces the same six-digit codes in Chrome. Q: Can I set up Nintendo 2-Step Verification without a phone? A: Yes. Setup happens on the Nintendo Account website, and all it needs is an app that produces the codes. With the extension, the whole thing — scanning the QR code, entering the code, saving backup codes — happens on your computer. Q: What if I lose access to my authenticator? A: On the 2-Step Verification screen at sign-in, select “Use another method to verify your identity” and enter one of your 10 backup codes. Without them, the same link on the backup code screen sends a verification code to your email address instead — but only if you still know your password. Keeping the extension’s automatic backups on means a reinstall does not put you there. Q: Why does Nintendo say my code is wrong? A: Usually the clock of the device that makes the codes is off — Nintendo’s own troubleshooting starts with syncing the time. Turn on automatic date and time on your computer and try the next code. If it still fails, sign in with a backup code, remove 2-Step Verification and set it up again. ### Fortnite (https://www.authenticator.sh/2fa/fortnite — steps checked on 2026-09-29; Fortnite's own instructions: https://www.epicgames.com/help/en-US/c-Category_EpicAccount/c-AccountSecurity/two-factor-authentication-2fa-and-how-to-enable-it-a000084651) Fortnite 2FA is two-factor authentication on your Epic Games account, and it works with any authenticator app — including one in your browser. On epicgames.com open Account → Password and security → Two-Factor Authentication, set up the authenticator app, and enter the six-digit code from the Authenticator extension. Fortnite has no separate 2FA setting: it uses your Epic Games account, so the setup happens on epicgames.com, not in the game. Gifting also needs account level 2 or higher and a friend you have had for at least two days. Turn on two-factor authentication for Fortnite: 1. Sign in at epicgames.com on your computer with the account you play Fortnite on, and open your “Account” page. 2. Go to the “Password and security” section. 3. Under “Two-Factor Authentication”, click “Set up” next to the authenticator app option. 4. Epic shows the setup for the app. Leave it on the screen and add it to the extension as described below. 5. Enter the code from the extension to finish. Epic shows the method as active and sends a confirmation email. Keep your Epic backup codes: When you turn on the authenticator app, Epic gives you eight-digit backup codes. Download or write them down and keep them away from this computer. If you ever lose the authenticator, the sign-in prompt has “Try another way”, where you can enter a backup code or verify by email instead. Q: How do I get the Boogie Down emote? A: Turn on two-factor authentication on the Epic Games account you play Fortnite with, then sign in to Fortnite — Epic grants the emote as the 2FA reward. Q: Why can’t I gift in Fortnite? A: Epic requires two-factor authentication to send gifts. Besides 2FA, your account must be level 2 or higher, the friend must have been on your list for at least two days, and you can send up to five gifts in 24 hours. Q: Do I need a phone for Fortnite 2FA? A: No. Epic accepts any third-party authenticator app, and email codes too. The Authenticator extension generates the codes in Chrome on your computer — convenient when you play on PC or a console with no phone at hand. Q: What if I get locked out of my Fortnite account? A: At the 2FA prompt choose “Try another way” and use email verification or a backup code. Once you are in, set the authenticator up again under “Password and security”. Keeping the extension’s automatic backups on means a reinstall does not lock you out. ### Ubisoft (https://www.authenticator.sh/2fa/ubisoft — steps checked on 2026-09-29; Ubisoft's own instructions: https://www.ubisoft.com/en-us/help/ubisoft-account/account/article/securing-your-account-with-2-step-verification-mobile-app/000063986) Ubisoft 2-Step verification works with a standard authenticator app, including one in your browser. On your Ubisoft account’s “Security” page choose “Activate” on the “Authenticator app” tile, follow the link Ubisoft emails you, and add the account to the Authenticator extension. Ubisoft finishes the setup through a link sent to your account email, so have your inbox open. It may also ask you to add a recovery phone number first. Only one 2-Step verification method is on at a time. Turn on 2-Step verification at Ubisoft: 1. Sign in to your Ubisoft account on your computer and open the “Security” page. 2. In the 2-Step verification section, choose “Activate” on the “Authenticator app” tile. 3. Add a recovery phone number if Ubisoft asks for one, then select “Send”. 4. Open the email Ubisoft sends, select the link in it and follow the instructions to set up the authenticator app. 5. When the setup shows a QR code, leave it on the screen and add it to the extension as described below — then enter the code from the extension to finish. Save your six Ubisoft recovery codes: Once 2-Step verification is on, Ubisoft gives you six recovery codes, each single-use. Save them somewhere other than this computer: a recovery code signs you in when the authenticator is not available. To get a fresh set, Ubisoft asks you to deactivate 2-Step verification and activate it again. Q: Do I need 2-Step verification for Rainbow Six Siege Ranked? A: On PC, yes. Ubisoft requires 2-Step verification and a phone number on your account to play Ranked and Siege Cup. The authenticator app counts as the 2-Step verification method. Q: Can I use Ubisoft 2-Step verification without a phone app? A: Yes. The authenticator app option accepts standard codes, which the Authenticator extension generates in Chrome on your computer. Ubisoft may still ask for a phone number as a recovery method. Q: What if I lose access to my authenticator? A: Sign in with one of your recovery codes, then deactivate 2-Step verification and set the authenticator up again. Without recovery codes, use “Can’t log in?” on the login page to reach Ubisoft’s account recovery form — slower, and it needs proof the account is yours. Q: Why does Ubisoft say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, sign in with a recovery code, deactivate 2-Step verification and set it up again. ### Activision (https://www.authenticator.sh/2fa/activision — steps checked on 2026-09-29; Activision's own instructions: https://support.activision.com/articles/using-two-factor-authentication-with-an-activision-account) Activision two-factor authentication works with any third-party authenticator app — Activision names Authy, Duo Mobile, Google Authenticator and Microsoft Authenticator, and one in your browser works the same way. In your Activision account open Privacy & Security → Two-Factor Authentication, select “Enable” next to “Authenticator App”, and add the account to the Authenticator extension. Activision can have several methods on at once — email, text messages and an authenticator app — with one set as primary. If it asks you to verify first, select “Send Code”, enter the six-character code from your email and select “Verify”. Turn on the authenticator app for your Activision account: 1. Sign in to your Activision account on your computer. 2. Open the “Privacy & Security” tab and find the “Two-Factor Authentication” section. 3. Select “Enable” in the “Authenticator App” row, and verify by email if Activision asks. 4. Follow the on-screen instructions: when Activision shows a QR code, leave it on the screen and add it to the extension as described below. 5. Enter the six-digit code from the extension and your password, then select “Activate”. Keep your ten Activision backup codes: When you turn on the authenticator app, Activision shows ten single-use backup codes and also emails them to you with the subject “Two-Factor Authentication Enabled”. Keep them somewhere other than this computer. To get ten new ones, open the “three dots” menu next to the authenticator app, choose “Disable Method”, and enable it again. To make the app your default, use “Set As Primary Method” in the same menu. Q: Why does Call of Duty ask me to add a phone number? A: On PC, Activision requires text-message two-factor authentication from free-to-play players — anyone who does not own a Call of Duty title released in the last two years on that PC platform. That requirement is specifically SMS; the authenticator app is still worth adding, because it comes with backup codes and text-message codes do not. Q: Can I use Activision 2FA without a phone app? A: Yes. Activision accepts third-party authenticator apps, and the Authenticator extension generates the same six-digit codes in Chrome on your computer. Q: What if I lose access to my authenticator? A: At the code prompt, use a backup code or choose “Use Different Method” to get a code by email or text. Once in, disable the authenticator method and enable it again to set it up anew. If you have no other way in, contact Activision Support. Q: Why does Activision say my code is wrong? A: Usually the computer clock is off by a minute or more — the codes refresh every 30 seconds and depend on the exact time. Turn on automatic date and time and try the next code. If it still fails, sign in with a backup code and set the authenticator up again. ### Yahoo (https://www.authenticator.sh/2fa/yahoo — steps checked on 2026-09-29; Yahoo's own instructions: https://help.yahoo.com/kb/SLN5013.html) Yahoo 2-step verification works with any authenticator app, including one in your browser. Open your Account Security page → 2-step verification, choose “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. Yahoo asks for at least two recovery methods on the account — such as a recovery phone number and email address — before you turn it on. If you sign in with Yahoo Account Key, turn Account Key off first: the two cannot be on at the same time. Turn on 2-step verification at Yahoo: 1. Sign in to your Yahoo Account Security page on your computer. 2. Under “Ways of signing in”, click “2-step verification”. 3. Select “Authenticator app” and click “Continue”. 4. Yahoo shows a QR code. Leave it on the screen and add it to the extension as described below, then click “Continue”. 5. Enter the code from the extension and click “Done”. Keep a way back into Yahoo: If Yahoo shows you a recovery code while you set up the authenticator, print it or write it down and keep it away from this computer. Beyond that, your way back is the recovery phone number and email address on the account — keep them current on the Account Security page — and the extension’s automatic backups. Q: Do I need the Yahoo app or Account Key for 2-step verification? A: No. Yahoo offers prompts in its own apps, but also accepts codes from any authenticator app. The Authenticator extension reads the QR code straight off the Account Security page and generates the codes in Chrome. Account Key has to be off before 2-step verification can be turned on. Q: My mail app stopped signing in after I turned on 2-step verification. A: Desktop mail programs such as Outlook or Apple Mail cannot ask for a code. On the Account Security page, generate an app password and enter it in the mail program instead of your normal Yahoo password. Q: What if I lose access to my authenticator? A: Use the recovery code if Yahoo gave you one, or the recovery methods on the account, to get back in — then set the authenticator up again. That is why Yahoo asks for two recovery methods before you start, and why keeping the extension’s automatic backups on matters. Q: Why does Yahoo say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension, turn 2-step verification off and on again, and add the new QR code. ### Workday (https://www.authenticator.sh/2fa/workday — steps checked on 2026-09-29) When Workday asks for an authenticator app, any standard one works — Google Authenticator, Microsoft Authenticator, or one in your browser. On the “Extra Verification Required” screen click “Set Up Now”, scan the QR code from the screen with the Authenticator extension, and enter the six-digit code. Workday’s sign-in rules are set by each employer, so your screens may differ. Some employers sign you in to Workday through the company’s own login (Okta, Microsoft, Duo) — then the codes belong to that system, and this guide applies only if it shows an “authenticator app” option with a QR code. Workday’s own help is behind your employer’s login, so there is no public page to link to. Set up the authenticator app in Workday: 1. Open your employer’s Workday sign-in page on your computer and sign in with your username and password. 2. On the “Extra Verification Required” screen, click “Set Up Now”. Workday may let you postpone this a few times with “Maybe Later”. 3. The “Set Up Authenticator App” screen shows a QR code and a secret key. 4. Leave the QR code on the screen and add it to the extension as described below — or copy the secret key for manual entry. 5. Enter the six-digit code from the extension into Workday and continue. Save your Workday backup codes: If your employer has them turned on, Workday shows a set of single-use backup codes right after setup. Write them down or save them somewhere other than this computer — each signs you in once when the authenticator is not at hand. If Workday shows none, your way back is your HR or IT help desk, which can reset your authenticator. Q: Do I have to install an app on my personal phone for Workday? A: No. Workday only checks the six-digit code, and any standard authenticator produces it. The Authenticator extension generates the codes in Chrome on your work computer and reads the QR code straight off the Workday setup screen. Q: I got a new phone or computer. How do I move my Workday authenticator? A: With the extension, export a backup or restore one of its automatic backups on the new computer — the codes carry on working. If the old device is gone, sign in with a backup code or ask your HR or IT help desk to reset your authenticator, then scan the new QR code. Q: Can I use Duo or another paid app for Workday? A: Only if your employer set Workday up with it. Workday’s own authenticator option uses standard codes that free apps generate; some employers warn that apps like Duo are not licensed for it. Use whatever the setup screen asks for. Q: Why does Workday say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — ask your help desk to reset the authenticator and set it up again. ### Availity (https://www.authenticator.sh/2fa/availity — steps checked on 2026-10-07; Availity's own instructions: https://essentials.availity.com/availity/help-open/source/portal_providers/account_administration/2-step/_topics/t_set_up_2_step_authentication_account.html) Availity Essentials now signs you in with an authenticator app, and any standard one works — including one in your browser. Go to your account menu → “My Account” → “Profile & Security” → “Update Authentication” → “Add another device”, choose the authenticator app, scan the QR code from the screen with the Authenticator extension, click “I’ve completed these steps” and enter the six-digit code. Availity retires text and voice codes on October 28, 2026; until then it switches organizations over in phases, and your administrators get 30 days’ notice. New users are asked to set up an authenticator right after their first sign-in — then the setup starts on its own and you begin at step 4. If your organization signs you in to Availity through its own login (single sign-on), the codes belong to that system, not to Availity. Switch Availity to an authenticator app: 1. Sign in to Availity Essentials on your computer. 2. Open your account menu at the top of the page (it shows your name, as “[Your Name]’s Account”) and choose “My Account”. 3. Go to “Profile & Security” and click “Update Authentication”. 4. Click “Add another device”, choose “Use an authenticator app” and click “Continue”. Availity shows a QR code and a secret key. 5. Add it to the extension as described below, then click “I’ve completed these steps” — only now does Availity show the field for the code. Type the current six-digit code from the extension into it. Download your Availity backup codes: Availity offers backup codes for the day the device with your authenticator is not at hand: download the text file it gives you and keep it somewhere only you can reach, away from this computer. Each code signs you in once. If you have neither the authenticator nor a backup code, your organization’s Availity administrator or Availity Client Services (800-282-4548, Monday to Friday, 8 a.m. to 8 p.m. Eastern) can reset your 2-step authentication. Q: Do I need a phone for Availity’s authenticator app? A: No. Availity names Google Authenticator and Microsoft Authenticator as examples, but it only checks the six-digit code, and any standard authenticator produces it. The Authenticator extension generates the codes in Chrome on your computer and reads the QR code straight off the Availity screen. Q: Availity says to “enter the provided secret key into your time-based authentication device”. What do I do? A: The extension is that device. Copy the secret key Availity shows next to the QR code, then in the extension choose “Add Account” → “Manual” → “Secret Key”, name the account “Availity” and paste the key. Then click “I’ve completed these steps” on Availity and type the six-digit code the extension shows. Q: I am in “Update Authentication” but there is no field for the code. A: The field comes later. Click “Add another device” and choose the authenticator app to get the QR code; once it is added to the extension, click “I’ve completed these steps”, and the next screen asks for the code. Q: Will my text-message codes keep working? A: Not after October 28, 2026 — from then on Availity Essentials accepts only an authenticator app (users who sign in through their organization’s single sign-on, and Essentials Pro users, are not affected). Add the authenticator now, while you can still sign in with a text code. ### eBay (https://www.authenticator.sh/2fa/ebay — steps checked on 2026-09-29; eBay's own instructions: https://www.ebay.com/help/account/protecting-account/tips-keeping-ebay-account-secure?id=4872) eBay 2 Step Verification works with any authenticator app — eBay names Google Authenticator, Microsoft Authenticator and Authy, and one in your browser works just as well. Open Account settings → Sign in and security → 2 Step Verification, choose “Authenticator App”, and scan the QR code from the screen with the Authenticator extension. eBay offers three kinds of second step — notifications in the eBay app, text messages and an authenticator app — and you switch between them from the same setting. If text messages are on now, choosing the authenticator replaces them. Turn on 2 Step Verification at eBay: 1. Sign in at ebay.com on your computer. 2. Click your name in the top left corner and choose “Account settings”. 3. Select “Sign in and security”. 4. Select “Edit” next to “2 Step Verification”, then choose “Authenticator App”. 5. eBay shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension on eBay to confirm. Plan a way back into eBay: eBay’s help pages do not describe backup codes for 2 Step Verification, so make your own way back before you need it. The simplest: while the QR code is on the screen, scan it with an authenticator app on your phone as well — both will show the same codes. Keep the extension’s automatic backups on, and keep your phone number and email address current in Sign in and security, because eBay customer service uses them to confirm it is you. Q: Do I need a phone app for eBay 2 Step Verification? A: No. eBay recommends phone apps like Google Authenticator or Authy, but all it checks is the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the eBay page and generates the codes in Chrome. Q: Is an authenticator app better than eBay’s text messages? A: Yes, for most people. A text message can be delayed, fail abroad, or be redirected by someone who takes over your phone number. An authenticator app makes the code on your own device and works without signal. Q: What if I lose access to my authenticator? A: eBay does not document backup codes, so the way back is a second copy of the account in another authenticator app, the extension’s automatic backups, or eBay customer service, who will verify your identity. Setting up the second copy takes a minute during setup; it cannot be done afterwards without the key. Q: Why does eBay say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again. ### Stripe (https://www.authenticator.sh/2fa/stripe — steps checked on 2026-09-29; Stripe's own instructions: https://support.stripe.com/questions/enable-two-step-authentication-using-an-authenticator-app) Stripe two-step authentication works with any authenticator app, including one in your browser. In the Stripe Dashboard open Personal details → Two-step authentication → Add authentication method, choose “Use an authenticator app”, and scan the QR code from the screen with the Authenticator extension. Stripe lets you have several methods at once — an authenticator app, a passkey, a security key — and recommends at least two. If you are on a team, an administrator can require two-step authentication for everyone in Team settings. Turn on two-step authentication in Stripe: 1. Sign in to the Stripe Dashboard on your computer and open your “Personal details” page. 2. In the “Two-step authentication” section, click “Add authentication method”. 3. Choose “Use an authenticator app”. 4. Stripe shows a QR code. Leave it on the screen and add it to the extension as described below — or select “Enter code manually” to copy the key. 5. Confirm the code shown in the extension to finish. Write down your Stripe backup code: When you first turn on two-step authentication, Stripe shows one backup code — only once. Write it down and keep it somewhere other than this computer. You can generate a new one in the two-step authentication settings, which cancels the old one. The backup code signs you in when your authenticator is not available. Q: Which authenticator apps work with Stripe? A: Stripe names Google Authenticator, Microsoft Authenticator, Authy, Duo Mobile and 1Password, and any app that produces standard six-digit codes works — including the Authenticator extension, which reads the QR code straight off the Dashboard. Q: Can several people on my team use the same Stripe login? A: They should not. Invite each person to the account with their own user in Team settings — each then sets up their own authenticator, and an administrator can reset it for them if they lose it. Q: What if I lose access to my authenticator? A: Sign in with your backup code, or ask an administrator of your Stripe account to reset your two-step authentication from Team settings. Otherwise, submit Stripe’s account recovery request — it can take a couple of business days, and the emailed link must be used within 48 hours. Q: How do I move Stripe codes to a new device? A: In the two-step authentication section, open the “…” menu next to the authenticator app and choose “Update”, then scan the new QR code. The old device stops working. With the extension you can instead keep the same account and restore it from a backup. ### TikTok (https://www.authenticator.sh/2fa/tiktok — steps checked on 2026-10-07; TikTok's own instructions: https://www.tiktok.com/support/faq_detail?id=7543604780950624824) TikTok 2-step verification works with any third-party authenticator app, including one in your browser. In the TikTok app open Settings and privacy → Security & permissions → 2-step verification, choose “Authenticator”, and add the QR code or key TikTok shows to the Authenticator extension. TikTok’s help describes this setting only in the TikTok mobile app, so the QR code appears on your phone, not on the computer — the steps further down show how to get it from the phone into the extension. TikTok also asks for at least two methods, so have your phone number or email ready as the second. Turn on 2-step verification in TikTok: 1. Open the TikTok app on your phone and tap “Profile” at the bottom. 2. Tap the Menu ☰ button at the top, then select “Settings and privacy”. 3. Tap “Security & permissions”, then “2-step verification”. 4. Choose “Authenticator” and at least one other method — phone or email — and tap “Turn on”. 5. TikTok shows a QR code and a key. Keep that screen open and add it to the extension as described below — then enter the code from the extension on the next screen in the TikTok app. Add TikTok to Authenticator (in place of the usual steps): 1. Install 2FA Authenticator from the Chrome Web Store on your computer and pin it to the toolbar. 2. Keep the QR code open in the TikTok app on your phone. On the computer, click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR with camera”, and allow the camera when Chrome asks. 3. Hold the phone’s screen up to the computer’s camera until the QR code is read. The account appears in the list with a six-digit code that changes every 30 seconds. 4. Type the current code from the extension into the TikTok app on your phone. If it is about to expire, wait for the next one. 5. TikTok confirms that 2-step verification is on. From now on, when it asks for a code — in the app or on tiktok.com — click the extension icon and read it off. No camera on the computer? Tap the option to copy the key on TikTok’s setup screen, send it to yourself, and add it in the extension with “Add Account” → “Manual” → “Secret Key” — then delete the message, since the key is as good as the codes themselves. Keep your TikTok recovery code: TikTok’s help mentions a recovery code you receive when you set up the authenticator — it is what lets you reset your authentication method if you lose the app. If TikTok shows it to you, write it down and keep it away from this computer. Beyond that, your way back is the second method you chose — your phone number or email — and the extension’s automatic backups. TikTok warns that proving your identity without the recovery code can take up to 30 days. Q: Which authenticator app works with TikTok? A: TikTok names Google Authenticator and Microsoft Authenticator, and any app that produces standard six-digit codes works — including the Authenticator extension in Chrome. It can read the QR code from your phone with the computer’s camera, or take the key TikTok shows. Q: Can I set up TikTok 2-step verification on my computer? A: TikTok’s help describes the setup only in its mobile app, so you start it there. The codes do not have to stay on the phone, though: once the account is in the extension, it gives you the code in Chrome whenever TikTok asks for one, on the computer or for the app. Q: What if I lose access to my authenticator? A: Use the other method you chose — TikTok requires two — or reset the authentication method with your recovery code. Without the code, choose “Need more help?” and verify your identity; TikTok says this can take up to 30 days. Keeping the extension’s automatic backups on means a reinstall does not lose the account. Q: Why does TikTok say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again in the TikTok app. ### LinkedIn (https://www.authenticator.sh/2fa/linkedin — steps checked on 2026-10-07; LinkedIn's own instructions: https://www.linkedin.com/help/linkedin/answer/a1381088) LinkedIn two-factor authentication works with any authenticator app, including one in your browser — LinkedIn recommends an app over text messages. Open Settings & Privacy → Sign in & security → Two-factor authentication, choose “Authenticator App”, and add the secret key LinkedIn shows to the Authenticator extension. LinkedIn’s help describes a secret key rather than a QR code. If no QR code appears, copy the key and add it with “Add Account” → “Manual” → “Secret Key” — the result is the same. Recruiter, Campaign Manager and Sales Navigator require two-factor authentication on your LinkedIn account; turning it off blocks access to them. Turn on two-factor authentication on LinkedIn: 1. Sign in at linkedin.com on your computer and click the “Me” icon at the top of the homepage. 2. Select “Settings & Privacy” from the dropdown. 3. Click “Sign in & security” on the left, then “Two-factor authentication”. 4. Click “Turn on”, then “Set up”, choose “Authenticator App” from the dropdown and click “Continue”. LinkedIn may ask for your password, a code sent to your email, or approval in the LinkedIn app. 5. LinkedIn shows the key for your authenticator. Leave that page open and add it to the extension as described below — then enter the six-digit code from the extension on LinkedIn to verify. Plan a way back into LinkedIn: LinkedIn’s help pages do not describe backup codes for two-factor authentication, so make your own way back before you need it. While the key is on the screen, add it to an authenticator app on your phone as well — both will show the same codes. Keep the extension’s automatic backups on. And stay signed in to LinkedIn on one other device: from a signed-in session you can turn two-factor authentication off and set it up again. Q: Do I need Microsoft Authenticator for LinkedIn? A: No. LinkedIn names Microsoft Authenticator as an example, but it accepts codes from any app that produces standard six-digit codes. The Authenticator extension generates them in Chrome on your computer — no phone needed. Q: Do I need two-factor authentication for Sales Navigator or Recruiter? A: Yes. LinkedIn requires everyone who uses Recruiter, Campaign Manager or Sales Navigator to turn on two-factor authentication on their LinkedIn.com account, and turning it off there blocks access to those products. Q: What if I lose access to my authenticator? A: If you are still signed in on any device, turn two-factor authentication off there and set it up again. If not, choose “verify your identity” on the code prompt — LinkedIn will ask for a photo of a government-issued ID before restoring access. A second copy of the key, or the extension’s automatic backups, avoids that. Q: Why does LinkedIn say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. LinkedIn also says a code that is refused, or that has eight digits instead of six, means the authenticator was not set up correctly — remove the account from the extension and set it up again. ### Patreon (https://www.authenticator.sh/2fa/patreon — steps checked on 2026-10-07; Patreon's own instructions: https://support.patreon.com/hc/en-us/articles/206538086-How-to-set-up-Two-factor-authentication) Patreon two-factor authentication works with any TOTP authenticator app, including one in your browser. On patreon.com open Settings → Account → Two-factor authentication, click “Use authenticator app”, save the recovery codes, and scan the QR code from the screen with the Authenticator extension. Two-factor authentication cannot be set up in the Patreon app — only on the Patreon website. Patreon also offers text messages, but the authenticator app keeps your codes off your phone number. Turn on two-factor authentication on Patreon: 1. Sign in at patreon.com on your computer. 2. Click “Settings” in the left sidebar. 3. Open the “Account” tab. 4. Under “Two-factor authentication”, click “Use authenticator app”. Patreon first shows your recovery codes — save them, then click “Ok”. 5. Patreon shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension on Patreon. Save your Patreon recovery codes: Patreon shows a set of backup recovery codes in a pop-up as you turn on two-factor authentication — before the QR code. They sign you in if you lose your authenticator, and Patreon says they are exactly like a password: keep them somewhere very secure, such as a password manager, and not only on this computer. Q: Can I use Patreon two-factor authentication without a phone? A: Yes. Patreon’s help speaks of a code from a mobile device and names Duo and Google Authenticator, but any app that produces standard time-based codes works. The Authenticator extension reads the QR code straight off the Patreon page and generates the codes in Chrome. Q: Why can’t I turn on two-factor authentication in the Patreon app? A: Patreon does not offer it there. Set it up once on patreon.com — after that the Patreon app asks for the same code when you sign in, and you can copy it from the extension. Q: What if I lose access to my authenticator? A: Sign in with one of your recovery codes, then set the authenticator up again. Without the codes, contact Patreon Support from the email address linked to your account — they will verify your identity before changing anything. Keeping the extension’s automatic backups on means a reinstall does not lose the account. Q: Why does Patreon say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set two-factor authentication up again. ### Etsy (https://www.authenticator.sh/2fa/etsy — steps checked on 2026-10-07; Etsy's own instructions: https://help.etsy.com/hc/en-us/articles/115015569567-How-to-Make-Your-Account-More-Secure) Etsy 2 factor authentication works with any authenticator app — Etsy names Google Authenticator, and one in your browser works just as well. Open Account settings → Security → Turn on 2FA, choose “Authenticator App”, and scan the QR code from the screen with the Authenticator extension. Etsy requires 2 factor authentication when you open a new shop and strongly recommends it for every buyer and seller. With it on, Etsy asks for a code on a new browser or device and every 30 days. In countries where Etsy cannot send codes by call or text, an authenticator app is the only option. Turn on 2 factor authentication at Etsy: 1. Sign in at etsy.com on your computer, select your profile icon and choose “Account settings”. 2. Go to “Security”. 3. Under “2 factor authentication”, choose “Turn on 2FA”. 4. Choose “Authenticator App” from the dropdown and select “Continue” — and “Continue” again past the suggestion to download an app. 5. Etsy shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the code from the extension in the box under the QR code and choose “Confirm”. Save your Etsy backup codes: Right after you confirm, Etsy gives you a set of 9-digit backup codes — shown only once. Choose “Save to your device” or “Copy codes”, keep them somewhere other than this computer, and select “Complete”. Each code works once, typed into the “Security Code” field instead of a code from your authenticator. Etsy Support will never ask for them. Q: Do I need a phone for Etsy 2 factor authentication? A: No. Etsy describes an authenticator app as one for Apple or Android devices, but all it checks is the code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Etsy page and generates the codes in Chrome. Q: Do I have to turn on 2 factor authentication to sell on Etsy? A: For a new shop, yes — the “Your Security” step of opening a shop asks for it, and you can choose “Authenticator App” there. The QR code appears on Etsy the same way, so the steps below work for it too. Existing sellers are not required to, but Etsy strongly recommends it. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes, then set 2 factor authentication up again from the “Security” page. Without a working backup code, choose “I still need help” at sign-in. Keeping the extension’s automatic backups on means a reinstall does not lose the account. Q: Why does Etsy say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again. ### Dropbox (https://www.authenticator.sh/2fa/dropbox — steps checked on 2026-10-07; Dropbox's own instructions: https://help.dropbox.com/account-access/enable-2-factor-authentication) Dropbox 2-factor authentication works with any authenticator app that supports standard time-based codes, including one in your browser. On dropbox.com open Settings → Security, turn on “2-factor authentication”, choose “Use an authenticator app”, and scan the QR code from the screen with the Authenticator extension. Dropbox sets this up only on dropbox.com, not in its desktop or mobile apps. If the “Security” tab says “Managed by single sign-on”, your team admin handles sign-in through a central identity provider, and Dropbox’s own 2-factor authentication is not needed. Turn on 2-factor authentication at Dropbox: 1. Sign in at dropbox.com on your computer and click your avatar — your profile picture or initials, top right or bottom left depending on your plan. 2. Click “Settings”, then open the “Security” tab. 3. Toggle “2-factor authentication” to “On”, re-enter your password and click “Submit”. 4. Select “Use an authenticator app”. 5. Dropbox shows a QR code. Leave it on the screen and add it to the extension as described below — or copy the “Secret key” instead — then click “Next”, enter the code from the extension and click “Next” again. Save your 10 Dropbox backup codes: Next Dropbox offers to add a secondary phone number — optional, “Skip for now” is fine — and then shows your recovery codes: ten eight-digit codes, each good once. Store them somewhere other than this computer, check “I’ve stored my recovery codes in a safe place” and click “Finish”. You can see them again under Settings → Security → “Show” next to “Recovery codes”. Turning 2-factor authentication off and on again resets them, so save the new set each time. Q: Can I use Dropbox 2-factor authentication without a phone? A: Yes. Dropbox’s help says any app that supports the Time-based One-Time Password (TOTP) protocol should work, and it only checks the six-digit code. The Authenticator extension reads the QR code straight off dropbox.com and generates the codes in Chrome on your computer. Q: What if I lose access to my authenticator? A: On the sign-in screen click “Having trouble getting a code?” and enter one of your emergency backup codes, or text a code to your backup phone if you added one. A computer signed in to the Dropbox desktop app is a trusted device and can open dropbox.com without a code. Once you are in, set the authenticator up again — and keep the extension’s automatic backups on so a reinstall does not put you here. Q: Why does Dropbox say my code is invalid? A: Usually the computer clock is off by a minute or more — Dropbox notes that authenticator apps depend on the device’s time. Turn on automatic date and time and try the next code. If it still fails, check you are copying the code of the right Dropbox account, or remove it from the extension and set 2-factor authentication up again. Q: Why doesn’t Dropbox ask me for a code? A: Because you are on a trusted device — a browser you signed in on before, or a computer with the Dropbox desktop app. To see the prompt again, clear the browser’s cookies or click “Revoke All” next to “Trusted Devices” under Settings → Security. ### Canva (https://www.authenticator.sh/2fa/canva — steps checked on 2026-10-07; Canva's own instructions: https://www.canva.com/help/login-verification/) Canva multi-factor authentication (MFA) works with any authenticator app, including one in your browser. Open Your account → Account and security, select “Enable” next to “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. Canva needs a verified email address and a password on the account first — if you have always logged in another way and have no password, set one under Settings → Login → Password. MFA is not available for accounts managed by single sign-on (SSO). Turn on multi-factor authentication in Canva: 1. Sign in at canva.com on your computer, select your account profile on the homepage and choose “Your account”. 2. Select “Account and security”. 3. In the “Security” section, under “Multi-Factor Authentication (MFA)”, select “Enable” next to “Authenticator app”. 4. Enter your password and select “Confirm password”. 5. Canva shows a QR code. Leave it on the screen and add it to the extension as described below — or select “Show secret key” to copy the key — then enter the code from the extension and select “Enable authenticator app”. Copy your Canva backup codes: Right after you enable the app, Canva shows backup codes: select “Copy codes”, store them somewhere other than this computer, and select “Finish setup”. Each code works once. If you use them up or lose them, the same MFA section has “Backup codes” with “Generate” or “Regenerate” — make a new set and keep it just as carefully. Q: Which authenticator app works with Canva? A: Any app that produces standard six-digit codes that change every 30 seconds — Canva leaves the choice to you. The Authenticator extension reads the QR code straight off the Canva settings page and generates the codes in Chrome, so no phone is needed. Q: What if I lose access to my authenticator? A: Log in with one of your backup codes, then disable the authenticator app and enable it again to set it up anew. Without backup codes, Canva’s account recovery form is the way to ask for access back — which is why copying the codes, and keeping the extension’s automatic backups on, matters. Q: Why does Canva say my code is incorrect? A: Canva’s own advice: let the current code expire and enter the new one straight away, and make sure your date and time sync automatically — on a computer, turn on automatic date and time in the system settings. If it still fails, check you are copying the code of the right Canva account in the extension. Q: Why can’t I turn on MFA in Canva? A: Check three things: your email address is verified, the account has a password (Settings → Login → Password), and it is not managed by your organization’s single sign-on — Canva does not offer MFA for SSO-managed accounts. ### AWS (https://www.authenticator.sh/2fa/aws — steps checked on 2026-10-07; AWS's own instructions: https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html) AWS calls an authenticator app a “virtual MFA device”, and any app that makes standard six-digit TOTP codes works — including one in your browser. Sign in as the root user, open Security credentials → Assign MFA device → Authenticator app, scan the QR code with the Authenticator extension, and enter two codes in a row. AWS asks for two consecutive codes, not one: type the code the extension shows into “MFA code 1”, wait until it changes — up to 30 seconds — and type the new one into “MFA code 2”. Then choose “Add MFA” right away; AWS warns that waiting too long leaves the device out of sync. For an IAM user, the same wizard is in the IAM console under Users → the user’s name → “Security credentials” tab → “Assign MFA device”. Assign a virtual MFA device in AWS: 1. Sign in to the AWS Management Console on your computer as the root user — choose “Root user” and enter the account’s email address and password. 2. On the right side of the navigation bar, choose your account name, then “Security credentials”. 3. In the “Multi-Factor Authentication (MFA)” section, choose “Assign MFA device”. 4. Type a “Device name” you will recognize, choose “Authenticator app”, then “Next”. 5. Choose “Show QR code”, leave it on the screen and add it to the extension as described below — then enter two consecutive codes from the extension into “MFA code 1” and “MFA code 2” and choose “Add MFA”. AWS has no backup codes — plan a second way in: AWS does not hand out backup codes. Instead it suggests a secure copy of the QR code or secret key, or more than one MFA device — the root user and each IAM user can register up to eight. The simplest: while the QR code is on the screen, scan it with an authenticator app on your phone as well, or add a passkey or security key afterwards. If every device is lost, the root user can still sign in by verifying the account’s email address and primary contact phone number, so keep both current; an IAM user has to ask an administrator to remove the device. Q: Can I use a browser authenticator as an AWS virtual MFA device? A: Yes. AWS accepts any app that follows RFC 6238, the standard for time-based six-digit codes, and does not check what device runs it. The Authenticator extension reads the QR code straight off the console. AWS does rate passkeys and security keys as stronger against phishing, so consider adding one as a second device. Q: What if I lose access to my authenticator? A: Sign in with another MFA device if you registered one. Otherwise, as the root user choose “Troubleshoot MFA” at the MFA prompt, then “Sign in using alternative factors”: AWS sends a verification email to the account address and calls the primary contact phone number. If neither is reachable, AWS Support has to remove the device. IAM users ask their administrator to deactivate it. Q: Why does AWS say my MFA code is wrong? A: Check the computer clock first: a clock a minute off produces codes AWS refuses. If the clock is right, the device may be out of sync — usually because the two setup codes were entered too slowly. Resync it under Security credentials: select the device, choose “Resync” and enter two consecutive codes. The troubleshooting link on the sign-in page offers the same. Q: Why does AWS ask for two MFA codes? A: It is how AWS confirms a new virtual MFA device, and the same two-code step is used to resync one later. Enter the current code in “MFA code 1”, wait for the code in the extension to change, and enter the new one in “MFA code 2” — not the same code twice. Then submit straight away. ### Cloudflare (https://www.authenticator.sh/2fa/cloudflare — steps checked on 2026-10-07; Cloudflare's own instructions: https://developers.cloudflare.com/fundamentals/user-profiles/2fa/) Cloudflare two-factor authentication works with any TOTP authenticator app, including one in your browser. In the dashboard open My Profile → Authentication, select “Add” under “Mobile App Authentication”, and scan the QR code from the screen with the Authenticator extension. Cloudflare needs a verified email address before 2FA is turned on — its docs warn that without one you may lock yourself out. It also recommends at least two different methods, for example the authenticator app and a security key. Turn on two-factor authentication at Cloudflare: 1. Sign in to the Cloudflare dashboard at dash.cloudflare.com on your computer. 2. Open the “My Profile” dropdown and select “My Profile”. 3. Select “Authentication”. 4. In the “Two-Factor Authentication” section, select “Set up” if it is shown, then “Add” under “Mobile App Authentication”. 5. Cloudflare shows a QR code. Leave it on the screen and add it to the extension as described below — or select “Can’t scan QR code, Follow alternative steps” for the key — then enter the code from the extension and your Cloudflare password. Save your Cloudflare backup codes: After the code is accepted, Cloudflare asks for your password again and shows backup codes: select “Download”, “Print” or “Copy”, keep them somewhere other than this computer, and select “Next” to finish. Each code works once. You can get a fresh set any time under Authentication → Two-Factor Authentication → “Manage” → “Regenerate” next to “Backup codes” — the old ones stop working. Q: Which authenticator app works with Cloudflare? A: Cloudflare names Google Authenticator and Microsoft Authenticator, and any app that makes standard time-based codes (TOTP) works the same — including the Authenticator extension, which reads the QR code straight off the dashboard. No phone needed. Q: What if I lose access to my authenticator? A: On the “Two-Factor Authentication” sign-in page, enter a backup code instead. Without backup codes, select “Try recovery” under “Lost all 2FA devices and backup codes?”: Cloudflare emails you a code, checks that you are on a device you have signed in from before, and then sends instructions within 3–5 days — a wait it says cannot be sped up. Q: Why does Cloudflare reject my code? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If you set the authenticator up again at some point, the old account in the extension stopped working — Cloudflare invalidates the previous codes — so remove it and add the new QR code. Q: Cloudflare wants 2FA before I can join an account. Why? A: The account’s Super Administrator has turned on 2FA Enforcement, which requires every member to use two-factor authentication. Set up the authenticator app as described above, then accept the invitation. While enforcement is on, you may not be allowed to turn 2FA off. ### EA (https://www.authenticator.sh/2fa/ea — steps checked on 2026-10-07; EA's own instructions: https://help.ea.com/en/articles/security-and-rules/two-factor-authentication/) EA two-factor authentication works with an authenticator app, and EA does not tie it to an app of its own — so one in your browser works too. On your EA Account’s Security and Privacy page open Two-factor authentication, choose the “Authenticator app” tab, and add the account to the Authenticator extension. EA offers three ways to get codes — email, an authenticator app and text messages — and lets you keep several, with one set as preferred. If 2FA is already on with email codes, select “Edit” next to your verification methods instead of “Turn On”. EA may ask you to verify it is you before it changes security settings. Turn on two-factor authentication at EA: 1. Sign in to your EA Account at myaccount.ea.com on your computer and open the “Security and Privacy” page. 2. Scroll down and select “Two-factor authentication”. 3. Select “Turn On” — or “Edit” next to your verification methods if 2FA is already on. 4. Choose the “Authenticator app” tab and select “Set up”. 5. Follow the on-screen steps. When EA shows the QR code, leave it on the screen and add it to the extension as described below — then enter the code from the extension to verify. View and save your EA backup codes: Once 2FA is on, select “View backup codes” and write the codes down somewhere other than this computer. EA is blunt about why: if you cannot use your chosen verification method, backup codes are the only way to sign in to your EA Account from a new device. EA’s help does not say how many you get — save all of them, and keep the extension’s automatic backups on as well. Q: Do I need a phone app for EA two-factor authentication? A: No. EA’s instructions mention a mobile device because that is where most people keep an authenticator, but all EA checks is the six-digit code. The Authenticator extension generates it in Chrome on your computer and can read the QR code straight off the EA Account page. Q: Can I keep email codes as well as the authenticator app? A: Yes. EA lets you have several verification methods on at once, shows them all under Two-factor authentication, and lets you set a preferred one. If the preferred method is not at hand when you sign in, you can choose another one you have enabled. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes or another method you enabled, then select “Edit” under Two-factor authentication to set the authenticator up again. With none of them, contact EA Help to recover the account — which is why saving the backup codes, and keeping the extension’s automatic backups on, matters. Q: Why does EA say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code — and if the current one is about to run out, wait for a new one. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again. ### Rockstar Games (https://www.authenticator.sh/2fa/rockstar-games — steps checked on 2026-10-07; Rockstar Games's own instructions: https://support.rockstargames.com/articles/1c5O1fKIOo0iG9W7y7WtM4/setting-up-2-step-verification-with-rockstar-games) Rockstar Games 2-Step Verification works with an authenticator app on your phone or one in your browser — Rockstar says so itself. Sign in at rockstargames.com, open Account → Manage Account → Security, and scan the QR code from the screen with the Authenticator extension. Rockstar requires the email address on your account to be verified before 2-Step Verification can be set up. To finish, it asks for both the code and your account password. Turn on 2-Step Verification at Rockstar Games: 1. Sign in to your Rockstar Games account at rockstargames.com on your computer. 2. Select your account icon in the upper right, then “Account”. 3. Select “Manage Account”, then “Security”. 4. Rockstar shows a QR code on the page. Leave it on the screen and add it to the extension as described below — or use the “Secret Key” option if it will not scan. 5. Enter the code from the extension and your Rockstar Games account password in their fields, then select “Verify”. Plan a way back into Rockstar Games: Rockstar’s help pages describe no backup codes. For a lost authenticator they send you to the authenticator app’s own recovery, and Rockstar strongly recommends an app with backups for exactly that reason. So keep the extension’s automatic backups on, or scan the same QR code with an authenticator on your phone before you select “Verify” — both will show the same codes. Keep the Secret Key as private as a password: the codes are made from it. Q: Rockstar’s list of apps has no browser extension. Will it work? A: Yes. Rockstar’s list names Authy, Google Authenticator, Microsoft Authenticator and 1Password, but its setup instructions say 2-Step Verification works with a browser-based authenticator app too, and tell you to scan the QR code “using your authenticator app or option in your browser”. The Authenticator extension produces the same standard codes in Chrome. Q: Do I have to enter a code every time I play GTA Online? A: No. Once 2-Step Verification is on, Rockstar offers to remember the device, and remembered devices skip the code on later sign-ins. Leave it off on shared or public computers. Q: What if I lose access to my authenticator? A: Rockstar documents no backup codes — its page for a lost authenticator only points to the recovery steps of the app you used. With the extension, that means restoring one of its automatic backups or an exported backup file. If that is not possible, submit a request to Rockstar Support. Q: Why does Rockstar say “Incorrect verification code” (#0.200.4)? A: Rockstar names three causes: the code was mistyped or expired, the clock is off, or the authenticator changed. Turn on automatic date and time and try the next code. If you switched authenticators, open Security, select “Unlink” under “2-Step Verification Device”, and set it up again with the new QR code. ### Slack (https://www.authenticator.sh/2fa/slack — steps checked on 2026-10-07; Slack's own instructions: https://slack.com/help/articles/204509068-Set-up-two-factor-authentication) Slack two-factor authentication works with most time-based one-time password (TOTP) apps, including one in your browser. Open your account settings at my.slack.com/account/settings, expand “Two-factor Authentication”, choose “Use an app”, and scan the QR code from the screen with the Authenticator extension. Slack’s 2FA protects sign-ins with an email address and password. If your company signs you in to Slack with single sign-on (SSO), Slack says 2FA should be set up with your identity provider instead. Owners can require 2FA and limit it to authenticator apps. If you belong to several workspaces, set it up in each one separately. Turn on two-factor authentication in Slack: 1. Sign in to your workspace in a browser on your computer and open your account page at my.slack.com/account/settings. 2. Next to “Two-factor Authentication”, click “Expand”. 3. Click “Set Up Two-Factor Authentication” and enter your password. 4. Click “Use an app” to get your codes from an authentication app. 5. Slack shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension and click “Verify Code”. Save your Slack backup codes: Slack gives you backup codes when you set up 2FA, and you can find them again on your Account page at any time. Each code works once, and it signs you in if you lose your device or delete the authentication app. Make a copy and keep it somewhere other than this computer. Q: Which authenticator apps work with Slack? A: Slack 2FA works with most time-based one-time password (TOTP) apps; Slack names Google Authenticator, Duo Mobile, 1Password, Authy and Microsoft Authenticator. The Authenticator extension produces the same standard codes in Chrome — no phone needed — and reads the QR code straight off the Slack account page. Q: I am in several Slack workspaces. Do I set up 2FA once? A: No — Slack treats the account in each workspace separately. Open your-workspace.slack.com/account/settings for each one, with your workspace’s own address, and set 2FA up there. Each appears in the extension as its own account; rename them so you can tell them apart. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes. Without them, ask a Workspace Owner or Admin to turn 2FA off for your account; if you are a Workspace Owner yourself, the Workspace Primary Owner can do it. Keeping the extension’s automatic backups on means a reinstall does not send you to your admin. Q: Why does Slack say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set 2FA up again. ### Zoom (https://www.authenticator.sh/2fa/zoom — steps checked on 2026-10-07; Zoom's own instructions: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0066054) Zoom two-step verification works with any app that supports time-based one-time passwords (TOTP), including one in your browser. In the Zoom web portal open Profile → Sign In → Two-Step Verification, click “Set Up” next to “Authentication App”, and scan the QR code from the screen with the Authenticator extension. Two-step verification is for accounts that sign in with an email address and password — what Zoom calls the work email login type. On a company or school account your admin decides: they can turn it on for everyone, choose which methods are allowed, and reset it if you lose your device. If your admin has turned it on, Zoom asks you to set it up the next time you sign in to the web portal. Turn on two-step verification in Zoom: 1. Sign in to the Zoom web portal at zoom.us on your computer. 2. In the navigation menu, click “Profile”. 3. Under “Sign In”, find “Two-Step Verification” — click “Turn On” if it is off — then click “Set Up” to the right of “Authentication App”. 4. Enter your password and click “Next”. 5. Zoom shows a QR code. Leave it on the screen and add it to the extension as described below — then click “Next”, enter the six-digit code from the extension and click “Verify”. Save your Zoom recovery codes: As soon as the code is verified, Zoom shows a list of recovery codes. Click “Download” or “Print”, then “Done”, and keep them somewhere other than this computer — each code works once. At sign-in, “Try another way” → “Recovery codes” gets you in without the authenticator. You can see the list again under Profile → Sign In → Two-Step Verification → Recovery Codes → “View Codes”. Q: Can I use Zoom two-step verification without a phone? A: Yes. Zoom’s requirements mention an Android or iOS device, but it accepts any app that supports the TOTP standard — and the Authenticator extension is one, running in Chrome on your computer. It reads the QR code straight off your Zoom Profile page. Q: Does the Zoom desktop app ask for the code too? A: Yes. With two-step verification on, the web portal, the desktop app, the mobile app and Zoom Rooms all ask for the code after your password. Click the extension’s icon in Chrome, copy the code and paste it in. Q: What if I lose access to my authenticator? A: At sign-in click “Try another way” → “Recovery codes” and enter one of your codes, then use “Change Device” under Two-Step Verification in your Profile to set the authenticator up again. Without recovery codes, ask your Zoom admin to reset your two-step verification — Zoom then has you set it up anew at the next sign-in. Q: Why does Zoom say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it fails during setup, click “Back” to show the QR code again and add the account to the extension anew. ### Shopify (https://www.authenticator.sh/2fa/shopify — steps checked on 2026-10-07; Shopify's own instructions: https://help.shopify.com/en/manual/your-account/logging-in/secure-sign-in/authenticator-app) Shopify two-step authentication works with any authenticator app, including one in your browser. In the Shopify admin open your profile → Security → Turn on two-step, choose “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. Two-step authentication belongs to your own Shopify login, not to the store: every owner and staff member turns it on in their own profile and gets their own recovery codes. Shopify is rolling out a refreshed admin design, so your store name may sit in a different place than described here. Turn on two-step authentication in Shopify: 1. Log in to your Shopify admin on your computer and click your store name. 2. Click your profile, then click “Security”. 3. In the “Two-step authentication” section, click “Turn on two-step”, enter your password and click “Next”. 4. From the “Authentication method” list, select “Authenticator app”. 5. Shopify shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension and click “Turn on”. Save your 10 Shopify recovery codes: When you set up two-step authentication, Shopify gives you 10 recovery codes — click “Copy codes”, or “Download codes” to get shopify_recovery_codes.txt. Each code works once. Keep them somewhere other than this computer, ideally in more than one place. If you did not save them, or have used them up, go to Security → Two-step authentication → Recovery methods and click “Regenerate codes”; the new list is shown only once. Q: Do I need a phone for Shopify two-step authentication? A: No. Shopify’s help lists phone apps such as Google Authenticator and Duo Mobile, but all Shopify checks is the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Shopify admin and generates the codes in Chrome. Q: Is two-step authentication required on Shopify? A: To use Shopify Payments, yes — Shopify requires it and warns that without it your payouts might be placed on hold. If your organization requires a secure sign-in method, or you have access to Shopify’s financial products, Shopify will not let you remove your last method. Q: What if I lose access to my authenticator? A: Log in with a backup method — Shopify Mobile prompts, a second authenticator app or a security key — or with one of your recovery codes. Without any of them, go to accounts.shopify.com, choose “Use a recovery code” and then “Recover my account”: Shopify emails you a code, may ask you to verify your identity, and reviews the request before restoring access. Q: Why does Shopify say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again. ### Intuit (https://www.authenticator.sh/2fa/intuit — steps checked on 2026-10-07; Intuit's own instructions: https://quickbooks.intuit.com/learn-support/en-us/intuit-account-settings/turn-on-or-turn-off-two-step-verification/00/185808) Your Intuit Account — the login for QuickBooks and TurboTax — accepts codes from an authenticator app, and Intuit names Google Authenticator and Microsoft Authenticator as examples. Turn on 2-step verification in Sign in & security, then select Authenticator → Set up authenticator app and add the account to the Authenticator extension. Intuit sets the authenticator up after 2-step verification, which first confirms your phone number with a text or voice message — have that phone at hand for the first part. Multi-factor authentication, the code Intuit sends when you sign in on a new device, is separate and cannot be turned off. Turn on the authenticator for your Intuit Account: 1. Sign in to your Intuit Account on your computer and select “Sign in & security”. 2. In the “2-step verification” section, select “Turn on”, then “Set up”. 3. Confirm your phone number, choose a text or voice message, enter the code and your password — Intuit confirms that 2-step verification is on. 4. Back in “Sign in & security”, select “Authenticator”, then “Set up authenticator app”. 5. Follow the instructions on the screen. When Intuit shows a QR code, leave that page open and add it to the extension as described below — then enter the six-digit code from the extension. Plan a way back into your Intuit Account: Intuit’s help pages do not describe backup codes for the authenticator, so make your own way back before you need it. While the QR code is on the screen, scan it with an authenticator app on your phone as well — both will show the same codes. Keep the phone number and email address in Sign in & security current, because Intuit uses them to recover the account when you cannot sign in, and keep the extension’s automatic backups on. Q: Does one authenticator cover QuickBooks and TurboTax? A: Yes, if you sign in to both with the same Intuit Account: the codes belong to the account, not to the product. If you use different user IDs for them, each is its own Intuit Account and needs its own setup. Credit Karma keeps its own login, so its security settings are separate. Q: Do I need a phone for Intuit’s authenticator? A: For the codes, no. Intuit suggests downloading an app from the App Store or Google Play, but it only checks the six-digit code, and the Authenticator extension produces it in Chrome. Turning on 2-step verification itself does need a phone number that can receive a text or voice message. Q: What if I lose access to my authenticator? A: Intuit does not document backup codes, so the way back is a second copy of the account in another authenticator app, the extension’s automatic backups, or account recovery through the phone number and email on the account. If you no longer have that phone number, changing it to turn 2-step verification off takes Intuit’s Proof of identity form with a copy of a driver’s license, state ID or passport. Q: Why does Intuit say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension, turn 2-step verification off and on again — that also turns the authenticator off — and set the authenticator up anew. ### WordPress.com (https://www.authenticator.sh/2fa/wordpress — steps checked on 2026-10-07; WordPress.com's own instructions: https://wordpress.com/support/security/two-step-authentication/) WordPress.com two-step authentication works with any authenticator app, including one in your browser. Open My WordPress.com account → Security → Two-Step Authentication, choose “Set up using an app”, and scan the QR code from the screen with the Authenticator extension. This is the setting for your WordPress.com account — the one you log in to at wordpress.com. A self-hosted WordPress site, running on your own hosting, has its own admin login that this setting does not cover; there two-factor authentication comes from a plugin. Turn on two-step authentication at WordPress.com: 1. Log in at wordpress.com on your computer, hover over your name in the top right corner and select “My WordPress.com account”. 2. Select “Security” in the menu on the side. 3. Click “Two-Step Authentication”. 4. Choose “Set up using an app”. 5. WordPress.com shows a QR code. Leave it on the screen and add it to the extension as described below — then type the six-digit code into the field and click “Enable”. Save your WordPress.com backup codes: Right after you click “Enable”, WordPress.com shows a set of backup codes. Copy, print or download them with the icons under the list, then type one into the field and click “Verify”. WordPress.com advises against keeping them on your computer — store them in a wallet, a safe or a password manager. Each code works once. You can generate a new set from a computer under Security → Two-Step Authentication → Backup codes, after entering a saved code; the old set then stops working. Q: Can I use WordPress.com two-step authentication without a phone? A: Yes. WordPress.com suggests phone apps like Google Authenticator and Authy, but it only checks the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Security page and generates the codes in Chrome. Q: Does this protect my self-hosted WordPress site? A: No. This setting protects your WordPress.com account. A WordPress site on your own hosting has its own admin login, and two-factor authentication there comes from a plugin. If the plugin offers an authenticator app and shows a QR code or a key, the extension adds it the same way. Q: What if I lose access to my authenticator? A: On the login screen click “Use a backup code instead” and enter one of your backup codes. WordPress.com says backup codes are the only way back in without staff assistance; without them, contact WordPress.com support to recover the account. Keep the extension’s automatic backups on so a reinstall does not lock you out. Q: Why does WordPress.com say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension, disable two-step authentication with a backup code, and set it up again. ### LastPass (https://www.authenticator.sh/2fa/lastpass — steps checked on 2026-10-07; LastPass's own instructions: https://support.lastpass.com/s/document-item?language=en_US&bundleId=lastpass&topicId=LastPass/enable-google-authenticator-mfa.html&_LANG=enus) LastPass multifactor authentication works with any standard authenticator app, not only LastPass Authenticator. In your vault open Account settings → Multifactor Options, edit “Google Authenticator”, view the barcode, and scan the QR code from the screen with the Authenticator extension. Choose the “Google Authenticator” option: it produces standard time-based codes, which any authenticator app can generate. LastPass Authenticator is LastPass’s own phone app and is set up with that app alone. Google Authenticator and Microsoft Authenticator cannot be on at the same time. LastPass Free includes authenticator apps; on Teams and Business, your admin’s policies may limit these settings. Turn on multifactor authentication in LastPass: 1. Log in at lastpass.com on your computer with your email address and master password, and open your vault. 2. Select “Account settings” in the left navigation menu, then the “Multifactor Options” tab. 3. Select the Edit icon for “Google Authenticator”, set “Enabled” to “Yes”, and choose whether to “Permit Offline Access”. 4. Next to “Barcode”, click “View” and enter your master password if asked. “View” next to “Private Key” shows the key for manual entry instead. 5. LastPass shows a QR code. Leave it on the screen and add it to the extension as described below — then select “Update”, enter your master password, and type the code from the extension when LastPass asks for it. Know your way back into LastPass: LastPass’s help does not describe backup codes for this option. Instead, if you lose the authenticator but know your master password, choose “Additional Multifactor Options” at the code prompt and select the “I’ve lost my … device” link: LastPass emails you a link that turns multifactor authentication off. That makes the email account behind LastPass your way back — protect it with its own two-step verification. LastPass also recommends turning on more than one multifactor option, ideally on different devices. Q: Which authenticator option should I pick in LastPass? A: “Google Authenticator”. It is not tied to Google’s app: it uses standard codes that any authenticator produces, including the Authenticator extension in Chrome. “Microsoft Authenticator” works the same way, but LastPass allows only one of the two at a time. It is available on LastPass Free as well — only hardware keys need Premium. Q: Can I keep the code for LastPass inside LastPass? A: Not the one that opens LastPass — you would need the vault to unlock the vault. LastPass can also hold codes for other sites, but then one master password guards both your passwords and their second step. A separate authenticator, like this extension, keeps the two apart; lock it with its own password too. Q: What if I lose access to my authenticator? A: If you know your master password, use the “I’ve lost my … device” link under “Additional Multifactor Options” at the code prompt — LastPass emails you a link that turns multifactor authentication off. Then turn it on again with a new QR code, and if the device was lost or stolen, change your master password as LastPass advises. Q: Why does LastPass say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, regenerate the key: edit “Google Authenticator” in Multifactor Options, click “Regenerate” next to “Regenerate Key”, and add the new QR code to the extension in place of the old account. ### GoDaddy (https://www.authenticator.sh/2fa/godaddy — steps checked on 2026-10-07; GoDaddy's own instructions: https://www.godaddy.com/help/enable-an-identity-verification-method-for-your-godaddy-account-42665) GoDaddy accepts any third-party authenticator app, including one in your browser. On your Security page choose “Add verification method” → “Authenticator app”, scan the barcode from the screen with the Authenticator extension, then switch on “2-Step Verification” so GoDaddy asks for the code every time you sign in. GoDaddy does this in two parts. Adding the authenticator app as a verification method makes GoDaddy ask for a code during high-risk actions and suspicious sign-ins; the “2-Step Verification” toggle, which can only be switched on once a method is added, makes it ask at every sign-in. GoDaddy recommends its own GoDaddy app, but lists the authenticator app as an equal choice. Turn on 2-Step Verification at GoDaddy: 1. Sign in to GoDaddy on your computer and go to your “Security” page. 2. In the “Security” list, below “Verification Methods”, select “Add verification method”. 3. Choose “Authenticator app” and select “Next”. 4. Skip GoDaddy’s instruction to install an app on your phone — the extension is the app. 5. GoDaddy shows a barcode (QR code). Leave it on the screen and add it to the extension as described below — GoDaddy also asks for the app’s name. Once the method is listed, switch on the “2-Step Verification” toggle under “Enhanced Security” on the same page. Plan a way back into GoDaddy: GoDaddy’s help pages do not describe backup codes. Instead, GoDaddy recommends at least one more verification method, ideally on another device — the GoDaddy app or an authenticator app on your phone, or your phone number — so losing one method does not lock you out. Keep the extension’s automatic backups on as well. If every method fails, GoDaddy support will ask you to verify with one of them before helping. Q: Do I need the GoDaddy app or a phone for 2-Step Verification? A: No. GoDaddy recommends its own app, but also accepts any third-party authenticator such as Google Authenticator or Authy. The Authenticator extension generates the same six-digit codes in Chrome and reads the barcode straight off the GoDaddy page. Q: I added the authenticator, but GoDaddy does not ask for a code when I sign in. A: A verification method alone is used only for high-risk actions and sign-ins GoDaddy finds suspicious. To be asked every time, open your Security page and switch on the “2-Step Verification” toggle under “Enhanced Security”. Q: What if I lose access to my authenticator? A: Verify with your other method — the GoDaddy app, another authenticator or your phone number — then remove the lost one and add the authenticator again. That is why GoDaddy asks for a backup method on a second device, and why keeping the extension’s automatic backups on matters. Q: Why does GoDaddy say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old barcode — remove it from the extension and add the authenticator method again. ### Wix (https://www.authenticator.sh/2fa/wix — steps checked on 2026-10-07; Wix's own instructions: https://support.wix.com/en/article/using-an-authenticator-app-for-2-step-verification-for-your-wix-account) Wix 2-Step verification works with any authenticator app, including one in your browser. In Account Settings scroll to “2-Step verification”, click “Enable” next to “Verify logins with an authenticator app”, scan the QR code from the screen with the Authenticator extension, and submit the six-digit code. Wix recommends setting up a recovery phone number before turning on 2-Step verification. You can have several methods on at once; Wix asks for them in a fixed order — the Wix app first, then the authenticator app, then SMS, then email — and at sign-in you can pick another one. Turn on the authenticator app in Wix: 1. Sign in to your Wix account on your computer and go to “Account Settings”. 2. Scroll down to “2-Step verification”. 3. Click “Enable” next to “Verify logins with an authenticator app”. 4. Enter your Wix password in the pop-up. 5. Wix shows a QR code. Leave it on the screen and add it to the extension as described below — then click “Next”, enter the six-digit code and click “Submit”. Add a second way into Wix: Wix lists “Recovery Code” among its 2-Step verification methods — a saved backup code for when your other methods are not available. If you turn it on in the same “2-Step verification” section, keep the code somewhere other than this computer. Add a second method too, such as SMS or the Wix app: with no working method left, the only way back is Wix’s account recovery form, and 2-Step verification has to be set up again afterwards. Q: Do I need the Wix app or a phone for 2-Step verification? A: No. Wix names Google Authenticator, Microsoft Authenticator, Authy, Duo Mobile and LastPass Authenticator, but any app that produces standard six-digit codes works. The Authenticator extension reads the QR code straight off the Wix page and generates the codes in Chrome. Q: Why does Wix not ask me for a code every time? A: Wix asks only when you sign in with your email and password, and it remembers a device for 30 days by default. On a new device or after 30 days, it asks again. Q: What if I lose access to my authenticator? A: At sign-in, choose another method you set up — a recovery code, SMS, the Wix app or email — then use “Reset App” in 2-Step verification to connect the authenticator again. With no method left, fill in Wix’s account recovery form. Keeping the extension’s automatic backups on means a reinstall does not get that far. Q: Why does Wix say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — click “Reset App” in 2-Step verification and add the new QR code. ### Evernote (https://www.authenticator.sh/2fa/evernote — steps checked on 2026-10-07; Evernote's own instructions: https://help.evernote.com/hc/en-us/articles/208314238) Evernote two-step verification works with any authenticator app that supports TOTP, not only Google Authenticator — including one in your browser. In your account settings open Account Security, click “Enable” next to “Two-Step Verification”, and scan the QR code from the screen with the Authenticator extension. Evernote asks you to verify your email address during setup. After the QR code it shows your backup codes and asks you to paste one of them back to finish — that code stays valid. Scanners and apps that do not support two-step verification need an application password instead of your real one, created in the same section. Turn on two-step verification in Evernote: 1. Sign in to your Evernote account settings on your computer. 2. Select “Account Security” from the menu. 3. Click “Enable” next to “Two-Step Verification”. 4. Verify your email address when Evernote asks. 5. Evernote shows a QR code for an authenticator app. Leave it on the screen and add it to the extension as described below — then enter the code from the extension. Save your Evernote backup codes: Right after setup Evernote shows a set of backup codes. Print or save them somewhere other than this computer — and not in Evernote itself, as Evernote warns. Each code works once; to get new ones, open Account Security → “Manage” next to “Two-step verification” → “Manage settings” → “View backup codes” → “Generate backup codes”. Evernote is blunt about the alternative: without a verification code or a backup code, you lose access to the account. Q: Do I need Google Authenticator for Evernote? A: No. Evernote’s instructions name Google Authenticator, but say any authenticator app that supports TOTP works the same way. The Authenticator extension reads the QR code straight off the account settings page and generates the codes in Chrome. Q: What if I lose access to my authenticator? A: On the code prompt choose “I need help getting a verification code” and use a backup code, or sign in with Google or Apple if they are connected to the account. Then reset two-step verification in Account Security. Without any of these, Evernote support asks for billing details, recent locations, devices and IP addresses — keeping the extension’s automatic backups on saves you that. Q: Why does Evernote say my code is invalid? A: Evernote accepts a code only for about a minute, so copy the current one and enter it straight away, without spaces. If it still fails, the computer clock is probably off — turn on automatic date and time and try the next code. Q: My scanner or another app stopped accepting my Evernote password. A: Some apps and devices cannot ask for a code. Create an application password under Account Security → “Manage” next to “Two-step verification” → “Generate New Application Password”, and enter it there instead of your Evernote password. ### Vimeo (https://www.authenticator.sh/2fa/vimeo — steps checked on 2026-10-07; Vimeo's own instructions: https://help.vimeo.com/hc/en-us/articles/12425450158353-Secure-your-account-with-two-factor-authentication) Vimeo two-factor authentication works with any authenticator app, including one in your browser. In Security Settings select “2FA”, choose “Two-Factor Authentication (2FA) - Authenticator”, scan the QR code from the screen with the Authenticator extension, verify with the six-digit code and save. Vimeo has one 2FA setting with three choices: email, authenticator, or none. Choosing the authenticator replaces email codes — although at sign-in Vimeo still lets you ask for a code by email instead. Turn on two-factor authentication on Vimeo: 1. Sign in at vimeo.com on your computer. 2. Open your “Security Settings” (vimeo.com/settings/account/security). 3. Select “2FA” and choose “Two-Factor Authentication (2FA) - Authenticator”. 4. A window opens with setup instructions. Skip the download step — the extension is the authenticator app. 5. Vimeo shows a QR code. Leave it on the screen and add it to the extension as described below — then verify with the six-digit code and save settings. Keep a way back into Vimeo: Vimeo’s help does not describe backup codes. Its way back is your email: at the code prompt you can ask for a code to be emailed instead. So keep the email address on your Vimeo account current and well protected — with 2FA of its own — and keep the extension’s automatic backups on. Q: Do I need a phone for Vimeo two-factor authentication? A: No. Vimeo names Google Authenticator and Authy, but any app that produces standard six-digit codes works. The Authenticator extension reads the QR code straight off the Vimeo page — or takes the code shown for manual entry — and generates the codes in Chrome. Q: Should I use Vimeo’s email codes or an authenticator app? A: An authenticator app. Email codes can land in spam or arrive late, and anyone who gets into your inbox gets your Vimeo codes too. An authenticator makes the code on your own device, with no network at all. Q: Vimeo says I am locked out after too many attempts. A: Vimeo blocks sign-in for 15 minutes after a series of failed attempts, and every new attempt restarts the wait — resetting the password does not help. Wait the 15 minutes, check the computer clock, and enter the current code. Q: Why does Vimeo say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, ask for a code by email, then set the authenticator up again in Security Settings and add the new QR code. ### Wikipedia (https://www.authenticator.sh/2fa/wikipedia — steps checked on 2026-10-07; Wikipedia's own instructions: https://meta.wikimedia.org/wiki/Help:Two-factor_authentication) Wikipedia two-factor authentication works with any authenticator app, including one in your browser, and since December 2025 every registered account can turn it on. Go to Special:AccountSecurity, choose “Add an authenticator app”, scan the QR code from the screen with the Authenticator extension, and save your recovery codes. One Wikimedia account signs you in to every Wikipedia and its sister projects such as Commons, Wiktionary and Meta, and 2FA set up on it covers them all; only the private wikis need their own. Wikimedia does not offer codes by SMS. Bots and tools such as AutoWikiBrowser cannot ask for a code — use bot passwords or OAuth for them. Turn on two-factor authentication on Wikipedia: 1. Sign in to Wikipedia on your computer. 2. Go to “Special:AccountSecurity” — or follow the link to it from your “Preferences”. Wikipedia may ask you to confirm it is you. 3. Click “Add an authenticator app”. 4. Give the app a name, so you can tell it apart if you add more than one. 5. Wikipedia shows a QR code — and, if you cannot scan it, the secret key and account name. Leave it on the screen and add it to the extension as described below. Save your ten Wikipedia recovery codes: When you turn 2FA on, Wikipedia gives you ten recovery codes — download or print them and keep them somewhere other than this computer. Each code works once; on the sign-in prompt choose to use recovery codes. You can see them again, or create a new set (the old one stops working), on Special:AccountSecurity. Adding more apps or security keys does not create more codes. Q: Can I use Wikipedia 2FA without a phone? A: Yes. Wikimedia’s own help recommends a desktop app if you have no smartphone, and any app that produces standard codes works. It notes this is slightly less safe, since someone with your computer and your password could sign in — so turn on the extension’s password protection. Q: Who can turn on two-factor authentication on Wikipedia? A: Every registered user, since December 2025 — before that it was limited to certain user groups. Since 2025 the Wikimedia Foundation requires it for some groups with extended rights, and from 2026 private wikis are open only to users with 2FA on. Q: What if I lose access to my authenticator? A: Sign in with one of your recovery codes, add a new authentication method, then remove the old one on Special:AccountSecurity. Without recovery codes, the last resort is emailing ca@wikimedia.org from your account’s email address — and Wikimedia does not guarantee it can restore access. Q: Why does Wikipedia say my code is wrong? A: Check the computer clock first: Wikimedia notes codes can fail with a time difference of just two minutes. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension and add the authenticator app again. ### HubSpot (https://www.authenticator.sh/2fa/hubspot — steps checked on 2026-10-07; HubSpot's own instructions: https://knowledge.hubspot.com/account-security/set-up-two-factor-authentication-for-your-hubspot-login) HubSpot two-factor authentication works with any third-party authenticator app, including one in your browser. Click the settings icon → General → Security → “Set up two-factor authentication (2FA)”, choose “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. On Starter, Professional and Enterprise, HubSpot asks you to set up 2FA at your first sign-in and it cannot be turned off — then the setup starts on its own and you begin at step 4. On free tools, a Super Admin can require it with “Enforce 2FA to log in”, and Super Admins can limit which methods the team may use. If you sign in with Google or Microsoft, HubSpot does not prompt you, but you can still turn it on here. Turn on two-factor authentication in HubSpot: 1. Sign in to HubSpot on your computer and click the settings icon in the top navigation bar. 2. In the left sidebar, go to “General” → “Security”. 3. In the “Two-factor authentication (2FA)” section, click “Set up two-factor authentication (2FA)”. 4. Choose “Authenticator app” and follow the instructions on the screen. 5. HubSpot shows a QR code. Leave it on the screen and add it to the extension as described below — then click “Next”, enter the six-digit code and click “Next” again. Save your HubSpot backup codes: Right after the code is accepted, HubSpot shows backup codes — click “Print” or “Download PDF” and keep them somewhere other than this computer. You can see them again under General → Security → “View backup codes”, where “Generate new codes” creates ten new ones and cancels the old set. HubSpot also recommends a secondary method — a second authenticator or text messages — added in the same section. Q: Do I need the HubSpot mobile app or a phone for 2FA? A: No. HubSpot’s “Authenticator app” option takes any app that produces standard six-digit codes — it names Google Authenticator, Authy and Duo. The Authenticator extension generates them in Chrome and reads the QR code straight off the Security page. HubSpot has also paused setting up new 2FA with its own mobile app. Q: Can I turn off two-factor authentication in HubSpot? A: Not on Starter, Professional or Enterprise, where it is required for every password sign-in. On free tools, or where your company requires single sign-on, you can remove it under General → Security — HubSpot recommends keeping it. Q: What if I lose access to my authenticator? A: Use a backup code or your secondary method at the sign-in prompt. Without either, click “Reset authentication device” and request a reset from your Super Admin; if there is none to ask, HubSpot verifies you with a photo ID or through support, which takes at least 48–72 hours. HubSpot support cannot simply turn your 2FA off. Q: Why does HubSpot say “This doesn’t look right”? A: HubSpot’s own answer is the clock: codes are based on the current time, so a clock that is off by a minute produces codes it refuses. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension and set the authenticator up again. ### Mailchimp (https://www.authenticator.sh/2fa/mailchimp — steps checked on 2026-10-07; Mailchimp's own instructions: https://mailchimp.com/help/set-up-a-two-factor-authentication-app-at-login/) Mailchimp 2-factor authentication works with authenticator apps like Google Authenticator — and one in your browser makes the same codes. Open your Account security page, choose “Authenticator app”, scan the QR code from the screen with the Authenticator extension, and click “Enable”. Once 2-factor authentication is on, Mailchimp does not let you remove it — only switch methods. When an Owner or Admin turns it on for their login, everyone else on the account has to set it up at their next sign-in. If you sign in to Mailchimp through Google or with your Intuit login (accounts set up through QuickBooks), the second step belongs to that sign-in, not to this setting. Turn on 2-factor authentication in Mailchimp: 1. Sign in at mailchimp.com on your computer with your Mailchimp username and password. 2. Click your profile icon and choose “Profile”. 3. Open the “Settings” drop-down and choose “Security” — the Account security page. 4. In the “2-factor authentication” section, select “Authenticator app” and click “Next”. 5. Under “Set up authenticator app”, Mailchimp shows a QR code. Leave it on the screen and add it to the extension as described below — then type the code into “Authenticator code” and click “Enable”. Save your Mailchimp backup code: The confirmation page shows a backup code — save it offline or on another device, away from this computer, then click “Close”. It is the way in if you lose your authenticator; after you use it, Mailchimp gives you a new one to save. If it is lost, Mailchimp’s help says you can generate a new one in your settings while you can still sign in. Q: Mailchimp’s help says the code needs a mobile device. Will a browser extension work? A: Yes. Mailchimp’s help assumes a phone app such as Google Authenticator, but that app makes standard time-based codes from the QR code, and the extension makes the same codes from the same QR code. If you want a phone as well, scan the QR code with it during setup — both will show the same codes. Q: Can I turn off 2-factor authentication in Mailchimp? A: No — once it is on, Mailchimp keeps it on. On the Account security page you can click “Reconfigure” to move it to another authenticator, or “Switch to SMS” to get codes by text message instead. Q: What if I lose access to my authenticator? A: Sign in with your backup code, then reconfigure the authenticator. Without the backup code, Mailchimp’s only way back is for an Admin to invite you again as a new user under a new username — the old one stays locked. Keeping the extension’s automatic backups on spares you that. Q: Why does Mailchimp say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. Also check that you copied the Mailchimp code, not another account’s — and if it still fails, click “Reconfigure” and add the new QR code. ### Zendesk (https://www.authenticator.sh/2fa/zendesk — steps checked on 2026-10-07; Zendesk's own instructions: https://support.zendesk.com/hc/en-us/articles/4408829277466-Using-two-factor-authentication-to-sign-in-to-Zendesk-Support) Zendesk two-factor authentication works with authenticator apps like Google Authenticator and Microsoft Authenticator — and one in your browser makes the same codes. In the agent interface open your profile → “Security settings” → “Manage” → “Set up 2FA”, choose “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. Your Zendesk admin can require 2FA for all team members (Admin Center → Account → Security → Advanced → Authentication) but cannot set it up for you — when it is required, the setup dialog opens at sign-in and you begin at step 4. Zendesk’s own 2FA covers only sign-in with email and password: if your company signs you in with Google or single sign-on (JWT, SAML), the codes belong to that system. Turn on two-factor authentication in Zendesk: 1. Sign in to your company’s Zendesk on your computer. 2. In the Support agent interface, click your user icon in the upper right and select “View profile”. 3. Open the “Security settings” tab, click “Manage” in the Two-factor Authentication section, then click “Set up 2FA”. 4. Select “Authenticator app” and click “Next”. 5. Zendesk shows a QR code. Leave it on the screen and add it to the extension as described below — or copy the secret key for manual entry — then enter the code and click “Save”. Copy your Zendesk recovery codes: After you click “Save”, Zendesk shows your recovery codes once: click “Copy recovery codes” and keep them somewhere other than this computer. Each code signs you in once in place of a passcode. If you use them all or cannot find them, your Zendesk admin or account owner can get a recovery code for you. Q: Zendesk asks for the mobile version of an authenticator app. Will a browser extension work? A: Zendesk’s help names phone apps — Google Authenticator, Microsoft Authenticator, Authy, Duo Mobile — but they make standard time-based codes from the QR code, and the extension makes the same codes from the same QR code. If your company insists on a phone, scan the QR code with a phone app too during setup; both will show the same codes. Q: What if I lose access to my authenticator? A: Enter one of your recovery codes when Zendesk asks for the passcode, then set the authenticator up again. If you have none left, ask your Zendesk admin or account owner — they can generate a recovery code for you. Keeping the extension’s automatic backups on avoids the request. Q: Why does Zendesk say my passcode is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — turn 2FA off and on in your profile, or ask your admin, and add the new QR code. Q: I sign in to Zendesk with Google or my company login. Where is 2FA? A: Not in Zendesk. Its two-factor authentication is only for email-and-password sign-in; with Google, JWT or SAML single sign-on, the second step is set up in that system — for Google, 2-Step Verification on your Google account. ### Zapier (https://www.authenticator.sh/2fa/zapier — steps checked on 2026-10-07; Zapier's own instructions: https://help.zapier.com/hc/en-us/articles/8496305453069-Set-up-two-factor-authentication-for-your-Zapier-account) Zapier two-factor authentication works with any authenticator app, including one in your browser. Open Settings → Security and data → Two-Factor Authentication → “Setup Two-Factor Authentication”, scan the code from the screen with the Authenticator extension, and enter the six-digit code. Zapier 2FA is set by each member for themselves — on Team and Enterprise plans the account’s owners and admins cannot turn it on or off for you. If your company signs in to Zapier through SAML single sign-on, 2FA cannot be turned on in Zapier at all; it is set up in the company’s login instead. Turn on two-factor authentication in Zapier: 1. Sign in at zapier.com on your computer and open your “Settings”. 2. In the left sidebar, under “My account”, select “Security and data”. 3. In the “Security” section, select “Two-Factor Authentication”, then click “Setup Two-Factor Authentication”. 4. In the “Get an Authentication App” section, click “Next Step”. 5. In the “Verify Code” section, Zapier shows a barcode — a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code and click “Next Step”. Save your 10 Zapier recovery codes: In “Save Your Recovery Codes”, click “Copy” or “Download” and keep the codes somewhere other than this computer; Zapier then asks you to enter one of them to prove you saved them. You can see them again in your two-factor authentication settings, and “Regenerate Codes” makes a new set of ten. Zapier is blunt: lose both the authenticator and these codes and the account is locked for good — its support team cannot restore access. On paid plans you can also add an emergency phone number. Q: Do I need a phone for Zapier two-factor authentication? A: No. Zapier names Google Authenticator and Authy, but all it checks is the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Zapier setup page and generates the codes in Chrome. Q: What if I lose access to my authenticator? A: At the sign-in prompt click “Use a recovery code”, enter an unused one, and set the authenticator up again. Without recovery codes Zapier cannot let you back in, which is why saving them — and keeping the extension’s automatic backups on — matters more here than almost anywhere. Q: Why does Zapier say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — disable 2FA with a recovery code, enable it again and add the new QR code. Q: How do I move Zapier 2FA to a new device or app? A: Zapier has no “switch device” button: disable two-factor authentication in the same settings, then enable it again and scan the new QR code. With the extension you can instead restore it from a backup on the new computer, and the codes carry on working. ### Zoho (https://www.authenticator.sh/2fa/zoho — steps checked on 2026-10-07; Zoho's own instructions: https://help.zoho.com/portal/en/kb/accounts/multi-factor-authentication/articles/mfa-totp) Zoho multi-factor authentication does not require Zoho’s own OneAuth app: its “OTP Authenticator” mode works with any standard authenticator, including one in your browser. Go to accounts.zoho.com → Multi-Factor Authentication → “Set up Now” under OTP Authenticator, and scan the QR code from the screen with the Authenticator extension. If your organization manages your Zoho account, its admin may enforce MFA and choose which modes are allowed — if “OTP Authenticator” is missing or cannot be set up, the policy does not allow it. If you already use another MFA mode, set the authenticator as your default afterwards with “MAKE PRIMARY” next to OTP authenticator. Turn on the OTP authenticator in Zoho: 1. Sign in at accounts.zoho.com on your computer. 2. Click “Multi-Factor Authentication” in the left menu. 3. Find “OTP Authenticator” among the MFA modes — Zoho’s own OneAuth app is listed separately. 4. Click “Set up Now” under “OTP Authenticator”. Zoho shows a QR code and the secret. 5. Leave the QR code on the screen and add it to the extension as described below — or copy the secret for manual entry — then click “Next”, enter the code and click “Verify”. Generate your Zoho backup verification codes: Zoho does not hand out backup codes on its own — generate them: in Multi-Factor Authentication click “MFA Recovery Options”, then “Generate new codes”, and copy or download them. They are 12-digit codes, shown only once, each works once, and a new set cancels the old one. Keep them somewhere other than this computer. Q: Do I need Zoho OneAuth? A: No. OneAuth is one of Zoho’s MFA modes; “OTP Authenticator” is another, and Zoho names Google Authenticator, Microsoft Authenticator and Authy for it. The Authenticator extension produces the same standard codes in Chrome and reads the QR code straight off the Zoho page. Q: My mail app stopped signing in after I turned on MFA. A: Mail programs such as Outlook or Thunderbird cannot ask for a code, and often report it as a wrong password. Generate an application-specific password in your Zoho account and enter it in the mail program instead of your normal password. Q: What if I lose access to my authenticator? A: At the MFA prompt click “Can’t access your device?” (or “Problem signing in?” first) and use a backup verification code. Without one, write to support@zohoaccounts.com: Zoho verifies your identity and gives you a one-time code. Once in, set the authenticator up again with “Change Configuration”. Q: Why does Zoho say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension, click “Change Configuration” under OTP authenticator and add the new QR code. ### 1Password (https://www.authenticator.sh/2fa/1password — steps checked on 2026-10-07; 1Password's own instructions: https://support.1password.com/two-factor-authentication/) 1Password’s own two-factor authentication works with any authenticator app — except 1Password itself, which is why a separate one in your browser fits. On 1Password.com open your name → Manage Account → More Actions → Manage Two-Factor Authentication, select “Set Up App”, and scan the QR code from the screen with the Authenticator extension. Two-factor authentication is set up on 1Password.com in the browser, not in the 1Password apps, and needs a 1Password membership. On 1Password Business an owner or administrator can require it for everyone under Policies → Authentication policy → “Enforce two-factor authentication”. If your organization uses Duo, you will not see the option at all — Duo already does this job. Turn on two-factor authentication on 1Password.com: 1. Sign in to your account on 1Password.com in your browser. 2. Select your name in the top right, then select “Manage Account”. 3. Select “More Actions” → “Manage Two-Factor Authentication”. 4. Select “Set Up App”. 1Password shows a QR code with a 16-character secret next to it — write the secret down before you go on. 5. Leave the QR code on the screen and add it to the extension as described below — then select “Next”, enter the six-digit code and select “Confirm”. Write down the 16-character secret: 1Password has no backup codes for two-factor authentication. Its backup is the 16-character secret shown next to the QR code: write it down and keep it somewhere safe, away from this computer — 1Password suggests with your passport and Emergency Kit. Typed into any authenticator, it brings the codes back. A 1Password recovery code does not help here: after a recovery, two-factor authentication stays on. Q: Which authenticator app should I use for my 1Password account? A: Any app that produces standard six-digit codes, except 1Password itself. 1Password names Authy, Microsoft Authenticator and Okta Verify as examples. The Authenticator extension works too, needs no phone, and keeps the code apart from your vault — which is the point. Q: Will 1Password ask for a code every time I unlock it? A: No. Once a device has accepted a code, 1Password asks again only if you sign out on it, change your email address or account password, regenerate your Secret Key, have your account recovered, or someone chooses “Require 2FA on Next Sign-in” for that device. Q: What if I lose access to my authenticator? A: Add the 16-character secret you wrote down to an authenticator again. Or, on a device or browser that is still signed in, turn two-factor authentication off and set it up anew — on 1Password.com you confirm that with your account password. With neither, ask your family organizer or team administrator to recover your account; that resets two-factor authentication. Q: Why does 1Password say my code is wrong? A: Usually the computer clock is off by a minute or more — 1Password’s own help says to check the date and time first. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension and set two-factor authentication up again. ### Dashlane (https://www.authenticator.sh/2fa/dashlane — steps checked on 2026-10-07; Dashlane's own instructions: https://support.dashlane.com/hc/en-us/articles/18406747387026-Use-2-factor-authentication-2FA-to-log-in-to-your-Dashlane-account) Dashlane’s 2-factor authentication works with any authenticator app, including one in your browser. In the Dashlane web app open Vault → Settings → Security settings, turn on “2-factor authentication”, and scan the QR code from the screen with the Authenticator extension. 2-factor authentication is turned on in Dashlane in a computer browser, through the Dashlane extension. A passwordless Dashlane account has no 2FA settings, and neither does one you sign in to through your organization’s single sign-on — ask your plan admin. Admins of a professional plan can enforce 2FA for members in the Admin Console’s policy settings. Turn on 2-factor authentication in Dashlane: 1. Log in to Dashlane in your browser on your computer. 2. In the “Vault” menu in the top left of the page, select “Settings”, then “Security settings”. 3. Turn on “2-factor authentication” and enter your Master Password if Dashlane asks for it. 4. Choose whether to use 2FA every time you log in or only on a new device, then enter your mobile number for recovery codes — select “Continue” after each. 5. Dashlane shows a QR code and a setup code. Leave it on the screen and add it to the extension as described below — then select “Continue”, enter the token and select “Confirm”. Download your Dashlane recovery codes: Right after you confirm the token, Dashlane shows a list of recovery codes: download them and keep them on a device other than this computer, then select “Done”. Getting back in without the authenticator takes two of them — one to log in and one to turn 2FA off. If you lose them, Dashlane can text two new ones to the number you gave during setup, and on a professional plan that enforces 2FA your admin can generate new ones. Turning 2FA off and on again replaces the old codes. Q: Do I need a phone for Dashlane 2-factor authentication? A: No. Dashlane names Google Authenticator, Microsoft Authenticator and Duo Mobile, but it only checks the six-digit token, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Dashlane page and generates the tokens in Chrome. Dashlane does ask for a phone number, but only to text you recovery codes. Q: Should I choose every login or only new devices? A: Only new devices asks for the token when Dashlane meets a device for the first time; every login asks each time and needs an internet connection whenever you open your vault. To change your choice later, turn 2FA off and on again — you will get new recovery codes. Q: What if I lose access to my authenticator? A: On the login screen select “Use a recovery code”, log in, and use a second recovery code to turn 2FA off — then set it up again. Without saved codes, select “Reset 2FA” to get two new ones by text to your setup number. Keep the extension’s automatic backups on too, so a reinstall does not cost you the token. Q: Why does Dashlane say my token is wrong? A: Usually the computer clock is off — Dashlane’s own help warns that the device with the authenticator and the one with Dashlane must show the same time. Turn on automatic date and time and try the next token. If it still fails, remove the account from the extension and set 2FA up again. ### NordPass (https://www.authenticator.sh/2fa/nordpass — steps checked on 2026-10-07; NordPass's own instructions: https://support.nordpass.com/hc/en-us/articles/360002770497) NordPass multi-factor authentication works with any authenticator app, including one in your browser. It is turned on in your Nord Account: open Account Settings → Multi-factor authentication (MFA) → Manage MFA, click “Set up” next to “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. MFA is set on your Nord Account, not in NordPass itself — the “Multi-factor Authentication (MFA)” toggle in NordPass settings takes you there — so it applies to NordVPN and NordLocker as well. NordPass Business accounts work differently: your organization’s admin decides whether you need an authenticator app, a security key or both, and NordPass asks you to set it up when you sign in. Turn on MFA for your Nord Account: 1. Sign in to your Nord Account at nordaccount.com on your computer. 2. Click your account name in the top right corner, choose “Account Settings” and switch to the “Multi-factor authentication (MFA)” section. 3. Click “Manage MFA” and enter the verification code Nord sends to your email. 4. Click “Set up” next to “Authenticator app”. Nord shows a QR code and a key. 5. Leave the QR code on the screen and add it to the extension as described below — then click “Continue” and enter the six-digit code from the extension. Save your Nord Account backup codes: Before setup finishes, Nord shows a set of one-time backup codes with “Copy” and “Print” buttons. Save them somewhere other than this computer — Nord suggests cloud storage or a paper copy in a hidden place — and click “Continue”. You can see them again, or get a new set, under Account Settings → Multi-factor authentication (MFA) → Manage MFA, after verifying your email. Q: Do I need a phone for NordPass MFA? A: No. NordPass names Google Authenticator, Microsoft Authenticator and Authy, “or any other”, and all it checks is the six-digit code. The Authenticator extension reads the QR code straight off the Nord Account page and generates the codes in Chrome — outside NordPass, which is where the code for NordPass should be. Q: Will MFA also apply to NordVPN and NordLocker? A: Yes. MFA is asked for when you sign in to your Nord Account, and that one account signs you in to NordPass, NordVPN and NordLocker. After that, NordPass still asks for your Master Password to unlock the vault. Q: What if I lose access to my authenticator? A: At the MFA step select “See other options” → “Enter one of your backup codes”. Without backup codes, contact NordPass Support. On NordPass Business, choose “Use Another Method” at sign-in, or ask your NordPass admin to reset your MFA. Q: Why does NordPass say my MFA code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. NordPass also reminds you that the code comes from your authenticator, not your email, and that MFA must be set up on the same email address as your NordPass account. ### Norton (https://www.authenticator.sh/2fa/norton — steps checked on 2026-10-07; Norton's own instructions: https://support.norton.com/sp/en/us/uhd/all/solutions/v100023155) Norton account two-factor authentication works with any authenticator app, including one in your browser. Sign in at my.norton.com, open Account Settings → Two-Factor Authentication → Set Up, choose “Mobile authenticator app”, and scan the QR code from the screen with the Authenticator extension. Norton needs a verified email address first: if the section shows “Verify your email” instead of “Set Up”, click it and confirm from the email Norton sends. The authenticator becomes your primary method; Norton recommends adding a phone number or a security key as a backup method afterwards. Turn on two-factor authentication in your Norton account: 1. Sign in to your Norton account at my.norton.com on your computer. 2. Hover over your profile icon in the top right corner and click “Account Settings”. 3. In the “Two-Factor Authentication” section, click “Set Up”. 4. Select “Mobile authenticator app” and click “Next”. 5. Norton shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension and click “Next”. Save your 10 Norton backup codes: Once the authenticator is set up, Norton shows 10 single-use backup codes — click “Download” or “Print” and keep them somewhere other than this computer. You can see them again under Account Settings → Two-Factor Authentication → “Show codes”, where used ones are struck through; “Get New Codes” replaces the whole set. Next to “Backup Methods”, click “Add a new method” to add a phone number or security key as well. Q: Which authenticator app works with my Norton account? A: Any free app that produces standard six-digit codes — Norton names VIP Access, Google Authenticator and Microsoft Authenticator. No phone is needed: the Authenticator extension reads the QR code straight off the Norton page and generates the codes in Chrome. Q: Why is my Norton account called “SOTP-…” in the authenticator? A: That is the name Norton gives the account in the QR code — its help shows it as NortonLifeLock with an ID such as SOTP-L2FCeFM. It is only a label. Rename it to “Norton” in the extension so you can find it; the codes do not change. Q: What if I lose access to my authenticator? A: Sign in with one of your 10 backup codes, or with your backup method if you added a phone number or security key. Then set the authenticator up again. Keeping the extension’s automatic backups on means a reinstall does not cost you the account. Q: Why does Norton say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again. ### Tumblr (https://www.authenticator.sh/2fa/tumblr — steps checked on 2026-10-07; Tumblr's own instructions: https://help.tumblr.com/knowledge-base/two-factor-authentication/) Tumblr two-factor authentication works with any authenticator app, including one in your browser. Open Settings, turn on Two-factor Authentication in the Security section, enter your password, and add the code Tumblr shows to the Authenticator extension. Tumblr asks for your account password during setup, and its codes come from an authenticator app only — so have the extension installed before you flip the switch. In the Tumblr apps the same setting is behind the account icon → gear icon → “General settings” (iOS) or “Account settings” (Android). Turn on two-factor authentication on Tumblr: 1. Sign in at tumblr.com on your computer. 2. Click “Settings” on the left — or go straight to your account settings at tumblr.com/settings/account. 3. In the “Security” section, turn on “Two-factor Authentication”. 4. Enter your Tumblr password and follow the steps to generate a code. 5. When Tumblr shows a QR code, leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension to finish. Generate your Tumblr backup codes: In the same “Security” section, click “Generate backup codes”, enter your password and click “Check Password”. Tumblr shows ten backup codes: copy them somewhere other than this computer, or print them with “Print Codes”. When you cannot reach your authenticator, a backup code signs you in instead. Q: Can I use Tumblr two-factor authentication without a phone? A: Yes. Tumblr only needs an authenticator app that produces single-use six-digit codes; it does not care what device runs it. The Authenticator extension produces them in Chrome on your computer and can read the QR code straight off the Tumblr settings page. Q: Do the Tumblr apps ask for the code too? A: Yes. Once two-factor authentication is on, you sign in as usual — on the web or in the app — and enter the code from your authenticator when Tumblr asks for it. On a phone, open the extension’s icon in Chrome on your computer and type the code it shows. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes, then turn two-factor authentication off and on again in the Security section to set it up anew — Tumblr makes you go through the whole setup again. Its help page describes no other way back, so generate the backup codes now and keep the extension’s automatic backups on. Q: Why does Tumblr say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set two-factor authentication up again. ### Substack (https://www.authenticator.sh/2fa/substack — steps checked on 2026-10-07; Substack's own instructions: https://support.substack.com/hc/en-us/articles/4785929336980-What-is-Two-Factor-Authentication-How-do-I-use-it) Substack two-factor authentication works with any authenticator app, including one in your browser. In Settings → Security set up “Recovery questions” first, then turn on two-factor authentication, scan the QR code from the screen with the Authenticator extension, and enter the six-digit code. Substack will not let you turn two-factor authentication on until recovery questions are set up — if the toggle is locked, that is why. The answers are your way back if you lose your authenticator, so choose ones you will remember exactly. Turn on two-factor authentication on Substack: 1. Sign in at substack.com on your computer and open your account “Settings” page. 2. In the “Security” section, click the toggle next to “Recovery questions” and set up your questions. 3. Click the toggle next to “Turn on two-factor authentication”. 4. Substack shows a QR code and a setup key. Leave the QR code on the screen and add it to the extension as described below — or copy the setup key for manual entry. 5. Enter the six-digit code from the extension and click “Enable two-factor authentication”. Your way back into Substack: recovery questions: Substack’s help describes no backup codes — the recovery questions you set up first are the way back. If you lose your authenticator, sign in with your email or password, click “Still not able to log in? Recover your account.” on the two-factor page, answer the questions and click “Reset”. Two-factor authentication is then off and you can set it up again. The challenge can expire, so answer it without leaving the page — and keep the extension’s automatic backups on as well. Q: Do I need a phone for Substack two-factor authentication? A: No. Substack points to apps from the App Store or Google Play, such as Google Authenticator or 1Password, but it only checks the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Substack settings page and generates the codes in Chrome. Q: Why is the two-factor authentication toggle locked? A: Because recovery questions are not set up yet. Turn on “Recovery questions” in the same Security section and answer them — the two-factor toggle unlocks afterwards. Q: What if I lose access to my authenticator? A: Sign in with your email or password, choose “Still not able to log in? Recover your account.” and answer your recovery questions to reset two-factor authentication. If you have lost access to your email address as well, follow Substack’s separate account recovery steps. Q: Why does Substack say my code is wrong? A: Usually the computer clock is off by a minute or more — the code changes every 30 seconds. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension, reset two-factor authentication and set it up again. ### Kickstarter (https://www.authenticator.sh/2fa/kickstarter — steps checked on 2026-10-07; Kickstarter's own instructions: https://help.kickstarter.com/en-us/articles/16236606-how-can-i-enable-two-factor-authentication) Kickstarter two-factor authentication works with any authentication app, including one in your browser. In your Account settings select “Set up two-factor authentication”, add the QR code from the screen to the Authenticator extension, and confirm with the six-digit code. Kickstarter asks for the code only when you sign in from a device it does not recognise, so you may go months without seeing it — which makes it easy to forget where the codes live. Its help offers no backup codes, so read the section on getting back in before you start. Turn on two-factor authentication at Kickstarter: 1. Sign in at kickstarter.com on your computer. 2. Open your profile menu and go to your “Account” settings. 3. Select “Set up two-factor authentication”. 4. If Kickstarter asks how you want to get codes, choose the authentication app. 5. Kickstarter shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension to finish. Plan a way back into Kickstarter: Kickstarter’s help pages do not describe backup codes; they say that if you cannot log in after changing devices, or cannot generate a code, you should contact Kickstarter’s Support team. So make your own way back before you need it: while the QR code is on the screen, scan it with an authenticator app on your phone as well — both will show the same codes — and keep the extension’s automatic backups on. Q: Do I need a phone app for Kickstarter two-factor authentication? A: No. Kickstarter’s help talks about setting up your phone, but all it checks is the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Kickstarter page and generates the codes in Chrome. Q: Why does Kickstarter not ask for the code every time? A: Kickstarter asks for it only when you sign in from a device it does not recognise — a new computer, a new browser, or after clearing cookies. On your usual computer you may not be asked at all for a long time. Q: What if I lose access to my authenticator? A: Kickstarter does not document backup codes, so the way back is a second copy of the account in another authenticator app, the extension’s automatic backups, or Kickstarter’s Support team. The second copy takes a minute during setup; it cannot be made afterwards without the key. Q: Why does Kickstarter say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set two-factor authentication up again. ### Plex (https://www.authenticator.sh/2fa/plex — steps checked on 2026-10-07; Plex's own instructions: https://support.plex.tv/articles/two-factor-authentication/) Plex two-factor authentication works with any authenticator app that uses standard TOTP, including one in your browser. On your Plex Account page open “Two-Factor Authentication”, click “Enable”, confirm your password, and scan the QR code from the screen with the Authenticator extension. Plex needs a password on the account and a verified email address before 2FA can be turned on — if you only sign in with Apple or Google, set a password on your Account page first. Signing in with Apple or Google skips Plex’s own code; that provider’s verification applies instead. Turn on two-factor authentication in Plex: 1. Sign in to Plex in your browser on your computer and open your “Account” page. 2. Find the “Two-Factor Authentication” section and open it. 3. Click “Enable” and confirm your account password. 4. Plex shows a QR code. Leave it on the screen and add it to the extension as described below — if it will not scan, use the text code Plex also provides. 5. Enter the six-digit code from the extension in the Plex setup to complete the link. Save your 10 Plex recovery codes: Right after the code is accepted, Plex shows 10 single-use recovery codes and a button to copy them. Keep them somewhere you can reach without this computer — Plex warns against storing them on the same device as your authenticator. You can generate a fresh set on your Account page with your password and a current code; the old set stops working. Q: Can I get Plex codes by text message instead? A: No. Plex does not send verification codes by SMS — it needs an authenticator app. If you would rather not use your phone, the Authenticator extension generates the codes in Chrome and reads the QR code straight off the Plex Account page. Q: What if I lose access to my authenticator? A: Sign in with a recovery code, then use a second one to turn 2FA off and set it up again. If the recovery codes are gone too, choose “Verify another way” at the code prompt to have a single-use code emailed to your account’s address — it is not a six-digit number. Q: A third-party Plex app does not ask for my code. How do I sign in? A: Add the current six-digit code to the end of your password. If your password is “secret” and the extension shows 123456, enter secret123456 as the password. Plex’s own apps and the website ask for the code on a separate screen. Q: Why does Plex say my code is wrong? A: Usually the computer clock is off — Plex itself warns that an inaccurate clock breaks the codes. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension and set 2FA up again with a recovery code. ### Samsung (https://www.authenticator.sh/2fa/samsung — steps checked on 2026-10-07; Samsung's own instructions: https://www.samsung.com/us/support/answer/ANS10001482/) Samsung account two-step verification accepts codes from an authenticator app, including one in your browser. On the Samsung account website open Security → Two-step verification → Authenticator app, scan the QR code from the screen with the Authenticator extension, and verify with the six-digit code. At least one phone number has to be registered for text-message codes; the authenticator is added alongside it. Samsung names Microsoft Authenticator as an example, but any standard app works. On a Galaxy phone the same settings are under Settings → your name → Security and privacy → Two-step verification. Add an authenticator app to your Samsung account: 1. Go to the Samsung account website on your computer and sign in. 2. Select “Security”, enter your password and select “Confirm”. 3. In the “Password and security” section, select “Two-step verification”. 4. Select “Authenticator app”. The “Set up your authenticator app” page shows a QR code and a key. 5. Leave the QR code on the screen and add it to the extension as described below — then click “Next”, enter the code from the extension under “Verify your authenticator app” and click “Verify”. Save your Samsung backup codes: Under Security → Two-step verification → “Backup codes”, Samsung shows your codes — download or print them and keep them away from this computer. They have to be saved in advance to be any use, and each works once; when they run out, “Get new codes” on the same page gives you a fresh set. To use one, choose “Didn’t get the verification code?” at sign-in, then “Verify with backup code”. Q: Do I need a Galaxy phone or Microsoft Authenticator for Samsung? A: No. Samsung names Microsoft Authenticator as an example, but its authenticator option uses standard six-digit codes that any authenticator app produces. The Authenticator extension reads the QR code straight off the Samsung account website and generates the codes in Chrome. Q: Can I turn off two-step verification on my Samsung account? A: No — Samsung says two-step verification cannot be disabled. You can choose which methods you use, and tick “Skip two-step verification on this phone next time” on a device you trust so it stops asking there. Q: What if I lose access to my authenticator? A: Sign in with a text-message code to your registered phone number, a code on one of your Galaxy devices, or a backup code — then set the authenticator up again. After too many code requests Samsung blocks text and voice codes for a few hours; it suggests waiting 24 hours, and otherwise contacting Samsung support. Q: Why does Samsung say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and add the authenticator app again. ### Uber (https://www.authenticator.sh/2fa/uber — steps checked on 2026-10-07; Uber's own instructions: https://help.uber.com/h/b8bb9152-8c91-4f49-83c4-35cf2e1dcf72) Uber 2-step verification works with authenticator apps — Uber calls them security apps — including one in your browser. Sign in at account.uber.com, open the “Security” tab, select “Authenticator app”, and add the code Uber shows to the Authenticator extension. Uber also offers codes by text message; with an authenticator app no phone number has to be attached for them. On some accounts the authenticator sits inside “2-step verification” rather than as its own item on the Security tab — choose the security app there. In the Uber app the same page is Account → Manage Uber account → Security. Turn on 2-step verification at Uber: 1. Sign in at account.uber.com on your computer. 2. Open the “Security” tab. 3. Select “Authenticator app” — or “2-step verification”, then the security app option. 4. Follow the steps on the “Authentication instructions” page. When Uber shows a QR code, leave it on the screen and add it to the extension as described below. 5. Enter the six-digit code from the extension and select “Next” to finish. Save your Uber backup codes: Uber gives you backup codes for 2-step verification and asks you to save them somewhere safe once it is set up — keep them away from this computer. Each code works once: on the verification screen choose an alternative method of verification, then “Use backup code”. If you use them all and cannot sign in to get new ones, Uber’s support team can help. Q: Does Uber accept an authenticator in the browser? A: Yes. Uber’s help says all third-party authenticator apps are supported and lists browser extensions among the ways to run one; it recommends Duo and Google Authenticator as examples. The Authenticator extension generates the same six-digit codes in Chrome. Q: Is a security app better than Uber’s text messages? A: For most people, yes. Uber notes that text messages may not arrive when you travel, have no signal or have opted out of its texts. A security app makes the code on your own device and works offline. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes, then set the authenticator up again on the Security tab. If the backup codes are used up or lost, contact Uber support — and keep the extension’s automatic backups on so a reinstall does not cost you the codes. Q: Why does Uber say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again. ### Atlassian (https://www.authenticator.sh/2fa/atlassian — steps checked on 2026-10-07; Atlassian's own instructions: https://support.atlassian.com/atlassian-account/docs/manage-two-step-verification-for-your-atlassian-account/) Atlassian two-step verification works with any authenticator app, including one in your browser — and one setting covers Jira, Confluence and Trello. Open your Atlassian account’s Security page → Manage two-step verification, choose “Enable authenticator app”, and scan the QR code from the screen with the Authenticator extension. Two-step verification belongs to your Atlassian account, not to Jira or Trello separately, so you set it up once. Turning it on keeps you signed in on this computer but may sign you out on your other devices. If your company signs you in through its own login (single sign-on), the second step is set up with that identity provider instead, and this setting does not apply. Turn on two-step verification for your Atlassian account: 1. Sign in to your Atlassian account on your computer and open its security page at id.atlassian.com/manage-profile/security. 2. Select “Manage two-step verification”. 3. Enter your password in the “Atlassian account password” field and select “Set up”. 4. Select “Enable authenticator app”. 5. Atlassian shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the code from the extension and follow the prompts to the end. Save your Atlassian emergency recovery key: During setup Atlassian gives you one emergency recovery key — copy, print or write it down and keep it somewhere other than this computer. At the code prompt, “Use recovery key” signs you in with it. Each key works once: after using it, Atlassian shows you a new one to save. If you lose the key while you are still signed in, “Create new emergency recovery key” in the two-step verification settings replaces it. Q: Can I use Atlassian two-step verification without a phone? A: Yes. Atlassian supports most authenticator apps — it names Google Authenticator, Authy and Duo — and all it checks is the six-digit code. The Authenticator extension reads the QR code straight off the Atlassian page and generates the codes in Chrome. Q: Does this one setting cover Jira, Confluence and Trello? A: Yes, for the cloud versions you sign in to with your Atlassian account — Trello’s own help points to the same setting. Two exceptions: Jira or Confluence running on your company’s own servers sign you in their own way, and Bitbucket Cloud’s help describes a two-step setting of its own. Q: What if I lose access to my authenticator? A: Sign in with your emergency recovery key, then set the authenticator up again. Without the key, ask your organization’s admin if it manages your account; otherwise, at the code prompt choose “Use recovery key?” → “Can’t find your recovery key?” → “Send recovery email”. Atlassian emails a one-time link 24 hours later, and it expires soon after — check your inbox on time. Q: Why does Atlassian say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If you have several Atlassian accounts, check you copied the code from the right one. If it still fails, remove the account from the extension, turn two-step verification off and on again, and add the new QR code. ### Figma (https://www.authenticator.sh/2fa/figma — steps checked on 2026-10-07; Figma's own instructions: https://help.figma.com/hc/en-us/articles/360039817634-Enable-two-factor-authentication-2FA) Figma two-factor authentication works with any authenticator app, including one in your browser. Open Settings → Security → Enable two-factor authentication, scan the code Figma shows straight from the screen with the Authenticator extension, and verify with the six-digit code. If you log in to Figma with Google or through your company’s SAML single sign-on, Figma has no two-factor setting for you — the second step is turned on with Google or your company’s login instead. On Figma Enterprise with Governance+, an organization can require two-factor authentication for all its members. Turn on two-factor authentication in Figma: 1. In the Figma file browser on your computer, click your name in the top-left corner and select “Settings”. 2. Open the “Security” tab and click “Enable two-factor authentication”. 3. Enter your password and click “Continue”. 4. Figma suggests authenticator apps to download. You already have one — click “Continue”. 5. Figma shows a barcode — a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension and click “Verify”. Save your Figma recovery codes: After the code is verified, click “Continue to recovery codes”, and Figma shows a list of recovery codes on the screen. Save them somewhere other than this computer — Figma suggests a password manager or encrypted file storage. Its help does not say how many there are or how to get a new set, so save the whole list the moment it appears. Q: Which authenticator apps work with Figma? A: Figma’s help names Google Authenticator, Duo Mobile, Authy and Microsoft Authenticator, and any app that produces standard six-digit codes works — including the Authenticator extension, which reads the code straight off the Figma settings page. No phone is needed. Q: I log in to Figma with Google. Where is the two-factor setting? A: There is none in Figma: with Google or SAML single sign-on, Figma leaves the second step to whoever signs you in. Turn on 2-Step Verification for your Google account — or ask your company’s IT about its login — and your Figma sign-in is protected by it. Q: What if I lose access to my authenticator? A: Use one of the recovery codes you saved during setup. Figma’s help does not describe a way back without them, so keep the codes somewhere safe, keep the extension’s automatic backups on, and contact Figma Support if both are gone. Q: Why does Figma say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old code — remove it from the extension, turn two-factor authentication off and on again, and add the new one. ### Heroku (https://www.authenticator.sh/2fa/heroku — steps checked on 2026-10-07; Heroku's own instructions: https://devcenter.heroku.com/articles/authenticator-apps) Heroku requires multi-factor authentication, and any standard authenticator app satisfies it — including one in your browser. In the Dashboard open Account Settings → Setup Multi-Factor Authentication → Add One Time Password Generator, and scan the QR code from the screen with the Authenticator extension. New Heroku accounts are asked to turn on multi-factor authentication as they are created — then the setup opens on its own, and you pick the one-time password generator there. If your team signs in to Heroku through single sign-on, multi-factor authentication is set up at that identity provider instead, and these steps do not apply. Add an authenticator app to Heroku: 1. Sign in to the Heroku Dashboard on your computer. 2. Open “Account Settings”. 3. Select “Setup Multi-Factor Authentication” — or “Manage Multi-Factor Authentication” if a verification method is already on. 4. Click “Add One Time Password Generator”. 5. Heroku shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the code from the extension and click “Connect”. Generate your 10 Heroku recovery codes: Recovery codes are a verification method of their own: on the same multi-factor authentication page choose “Add Recovery Codes”, and Heroku shows 10 single-use codes. Save them somewhere other than this computer — each stays valid until it is used, and you can generate a new set at any time. To sign in with one, click “Didn’t receive a notification?” → “Choose Another Verification Method” → “Recovery Codes”. Q: Do I need Salesforce Authenticator for Heroku? A: No. Salesforce Authenticator sends push notifications, but Heroku equally accepts a one-time password generator — any app that produces standard time-based codes. Heroku names Google Authenticator, Microsoft Authenticator and Authy; the Authenticator extension works the same way and reads the QR code straight off the Dashboard. Q: How do I log in to the Heroku CLI with multi-factor authentication? A: Run heroku login: it opens the browser, where you sign in to the Dashboard and enter the code from the extension. The --interactive option, which asks for the password in the terminal, cannot be used with multi-factor authentication. Q: What if I lose access to my authenticator? A: Sign in with a recovery code, then set the authenticator up again. In a Heroku Enterprise Account, an admin can send you a temporary verification code with “Send MFA Recovery Token” on the account’s Access tab. Otherwise contact Heroku Support, which may ask for extra information to make sure it is you. Q: Why does Heroku say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, remove the account from the extension, delete the one-time password generator under Manage Multi-Factor Authentication, and add it again. ### Okta (https://www.authenticator.sh/2fa/okta — steps checked on 2026-10-07; Okta's own instructions: https://help.okta.com/en-us/content/topics/security/mfa/google-authenticator.htm) When your organization’s Okta offers “Google Authenticator”, any standard authenticator app works — including one in your browser. Click “Set up” next to Google Authenticator when Okta asks, or under Settings → Security Methods, scan the QR code from the screen with the Authenticator extension, and enter the six-digit code. Okta is run by your employer or school, and its administrators decide which security methods you see, so your screens may differ — older Okta pages say “Setup security authenticators” instead of “security methods”. If “Google Authenticator” is not offered, your organization has not turned it on: use what it offers, or ask your IT help desk. Okta’s own page on it is written for administrators; the steps follow its section on what users see. Set up the Google Authenticator option in Okta: 1. Open your organization’s Okta sign-in page on your computer and sign in. 2. If Okta asks you to set up security methods, it lists them right away. Otherwise click the arrow beside your name on the Okta dashboard, choose “Settings”, and find “Security Methods”. 3. Click “Set up” next to “Google Authenticator”. 4. If Okta asks for your device type, pick iPhone or Android and click “Next” — it only changes the instructions on the screen. 5. Okta shows a QR code — do not click “Next” yet. Leave it on the screen and add it to the extension as described below, then click “Next”, type the code from the extension into “Enter Code” and click “Verify”. Plan a way back into Okta: Okta does not give you backup codes for this method. Your way back is your organization’s IT help desk, which can reset your security methods so you can set them up again. Make that unlikely to be needed: keep the extension’s automatic backups on, and if your organization offers a second method, set that up too. Q: Okta asks for Google Authenticator. Do I have to install it on my phone? A: No. Okta’s help describes the option as a standard time-based one-time password (TOTP), and all Okta checks is the six-digit code. The Authenticator extension generates the same codes in Chrome on your computer and reads the QR code straight off the Okta screen. Q: Is Okta Verify the same thing? A: No. Okta Verify is Okta’s own app, with push notifications only it can answer. If your organization offers both, the “Google Authenticator” option is the one that works with the extension; if it offers only Okta Verify, you need Okta Verify. Q: What if I lose access to my authenticator? A: Sign in with another security method if you set one up, or ask your IT help desk to reset Google Authenticator for your account, then scan the new QR code. With the extension, restoring one of its automatic backups on a new computer keeps the same codes working. Q: Why does Okta say my code is wrong? A: Usually the computer clock: Okta allows up to about two minutes of difference, and a clock further off produces codes it refuses. Turn on automatic date and time before trying again — after five wrong codes Okta stops accepting them for a while, and in some organizations until an administrator unlocks the account. ### IBMid (https://www.authenticator.sh/2fa/ibm — steps checked on 2026-10-07; IBMid's own instructions: https://www.ibm.com/docs/en/SSMF6R/mfasetup.html) IBMid accepts any standard authenticator app as its second step, not only IBM Verify — including one in your browser. Choose “Authenticator app” when IBMid asks for a method, name it, click “Proceed enrollment”, and scan the QR code from the screen with the Authenticator extension. IBM recommends setting up more than one method, so that losing a device does not lock you out. If your company signs you in to IBM through its own login (a federated IBMid), IBM sends you to that login instead of asking for your IBMid password, and the second step belongs to your company’s system. Add an authenticator app to your IBMid: 1. Sign in with your IBMid on your computer — at myibm.ibm.com, for example. 2. If no second step is set up yet, IBMid asks you to choose one right after your password. To add one later, open your IBMid security settings at login.ibm.com/usc/settings/security and click “Add new methods”. 3. Choose “Authenticator app”. 4. Give the method a name — IBM suggests naming it after the app, such as “Authenticator extension” — and click “Proceed enrollment”. 5. IBMid shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension to finish. Plan a way back into your IBMid: IBM’s IBMid help does not describe backup codes. Its advice is a second method: add your email address as another way to verify, so that if the authenticator is ever lost you can sign in with an email code and remove the old method from your security settings. A recovery email in your IBMid profile helps with password resets, and the extension’s automatic backups keep the codes themselves safe. Q: Do I need the IBM Verify app for IBMid? A: No. IBM Verify is one choice, but IBMid also offers “Authenticator app”, which IBM says works with Duo, Google Authenticator, Microsoft Authenticator and other apps following the same standard. The Authenticator extension is one of them and reads the QR code straight off the IBMid page. Q: What if I lose access to my authenticator? A: Sign in with your email as the second step, then remove the lost method in your security settings — hover over it, click the three dots and choose “Delete” — and add the authenticator again. If that does not work, IBM asks you to email IBMid support with a description of the problem. Q: IBMid says “The user account is locked”. What now? A: After five wrong passwords in a row an IBMid is locked for 30 minutes, then unlocks by itself — or reset your password to unlock it sooner. If the error comes after the second step, IBM’s help says the usual cause is a method that no longer works, and the fix is a ticket with IBMid support. Q: Why does IBMid say my code is wrong? A: Usually the computer clock is off by a minute or more — IBM’s help names time as the usual cause, including when IBMid sends you back to the sign-in page after the code. Turn on automatic date and time and try the next code. If it still fails, remove the authenticator from your security settings and add it again. ### ChatGPT (https://www.authenticator.sh/2fa/chatgpt — steps checked on 2026-10-07; ChatGPT's own instructions: https://help.openai.com/en/articles/7967234-managing-multi-factor-authentication-mfa) ChatGPT multi-factor authentication works with any authenticator app — OpenAI names Google Authenticator and Authy, and one in your browser works just as well. Open Settings → Security and login, choose the authenticator app under Multi-factor authentication (MFA), and scan the QR code from the screen with the Authenticator extension. MFA is tied to the way you signed in when you turned it on — email and password, or Google, Microsoft or Apple — and you must keep signing in that way while it is on. To switch, OpenAI says to turn MFA off first, sign in with the new method and turn it on again. Which MFA options you see can vary with your device, country, plan and how the account was created. Turn on multi-factor authentication in ChatGPT: 1. Sign in at chatgpt.com on your computer. 2. Click your profile in the lower left corner and choose “Settings” — or go straight to chatgpt.com/#settings/Security. 3. Select “Security and login”. 4. Under “Multi-factor authentication (MFA)”, choose the authenticator app and follow the instructions on the screen. 5. When ChatGPT shows a QR code, leave it on the screen and add it to the extension as described below — then enter the one-time code from the extension to finish. Plan a way back into ChatGPT: OpenAI’s help does not describe backup codes for MFA, and email is not a way past it: if you lose every method you set up, OpenAI Support has to verify you — which can take a few days — and then gives you a one-time email sign-in that works only once per account. So add a second method now, such as a passkey or text messages, in the same “Security and login” section, and while the QR code is on the screen, scan it with an authenticator app on your phone as well. Keep the extension’s automatic backups on. Q: Can I use ChatGPT MFA without a phone? A: Yes. OpenAI names phone apps like Google Authenticator and Authy, but all ChatGPT checks is the one-time code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the ChatGPT settings page and generates the codes in Chrome. Q: What if I lose access to my authenticator? A: At the sign-in prompt, choose another method you set up — a passkey, text messages or a second authenticator. With none left, contact OpenAI Support: after a verification that can take a few days, it gives you a one-time email sign-in, and you then have to add a new MFA method or turn MFA off. That rescue is offered only once. Q: Why does ChatGPT say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set the authenticator up again. Q: I sign in to ChatGPT with Google. Does MFA still work? A: MFA is set up for the way you signed in when you turned it on — Google, Microsoft, Apple, or email and password — and you must keep signing in that way until you turn it off. Which options appear can depend on how the account was created. Turning on 2-Step Verification for the Google account itself protects that sign-in as well. ### Mistral (https://www.authenticator.sh/2fa/mistral — steps checked on 2026-10-07; Mistral's own instructions: https://help.mistral.ai/en/articles/448331-how-do-i-update-my-account-information-email-password-and-2fa) Mistral two-factor authentication works with any TOTP authenticator app, including one in your browser. In Vibe — formerly Le Chat — select your organization name → Security & Access → Enable under Multi-factor authentication, scan the QR code from the screen with the Authenticator extension, and enter the code. Mistral renamed Le Chat to Vibe in May 2026; it still opens at chat.mistral.ai and the setting has not moved. Two-factor authentication is asked for from the next time you sign in. Turn on two-factor authentication in Mistral: 1. Sign in at chat.mistral.ai on your computer. 2. Select your organization name in the bottom-left corner of the screen. 3. Select “Security & Access”. 4. Under “Multi-factor authentication”, select “Enable”. 5. Mistral shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the code from the extension in the “2FA Code” field and select “Enable”. Generate your Mistral backup codes: Once two-factor authentication is on, select “Generate Codes” in the same section. Mistral shows the backup codes only once, so save them somewhere other than this computer and keep them secret; you can generate a new set later. If you lose your authenticator, sign in with a backup code, then turn two-factor authentication off or set it up again with a new authenticator. Q: Which authenticator app works with Mistral? A: Any TOTP app — Mistral names Google Authenticator, Microsoft Authenticator, 1Password, 2FAS, Aegis and Bitwarden. The Authenticator extension produces the same codes in Chrome and reads the QR code straight off the Vibe settings page, so no phone is needed. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes, then turn two-factor authentication off or set it up again with a new authenticator. Without backup codes, contact Mistral support from the email address on your account — and turn on the extension’s password protection and keep its automatic backups so a reinstall does not lock you out. Q: Why does Mistral say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set two-factor authentication up again. Q: Is Vibe the same account as Le Chat? A: Yes. Mistral renamed its assistant from Le Chat to Vibe in May 2026; conversations, settings and plans carried over, and it still lives at chat.mistral.ai. Mistral’s help now calls it Vibe throughout, so look for that name in its steps. ### Hugging Face (https://www.authenticator.sh/2fa/hugging-face — steps checked on 2026-10-07; Hugging Face's own instructions: https://huggingface.co/docs/hub/security-2fa) Hugging Face two-factor authentication works with any authenticator app, including one in your browser. Open Settings → Authentication → Add Two-Factor Authentication, scan the code the Hub shows straight from the screen with the Authenticator extension, and enter the six-digit code. Hugging Face names Authy, Google Authenticator, Microsoft Authenticator and FreeOTP, and any app that produces standard six-digit codes works. Organizations on the Team and Enterprise plans can require all their members to enable two-factor authentication. Turn on two-factor authentication on Hugging Face: 1. Log in at huggingface.co on your computer. 2. Click your profile picture in the top right corner and choose “Settings”. 3. Open the “Authentication” page of your settings. 4. Select “Add Two-Factor Authentication”. 5. The Hub shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension into “Code” and save. Download your Hugging Face recovery codes: As soon as the code is accepted, the Hub shows a list of recovery codes. Download them — the file is huggingface-recovery-codes.txt — or print them, and keep them somewhere other than this computer. Each code signs you in once. If you lose them or want a new set, open the Authentication settings, select “Recovery Code” and click “Regenerate recovery codes” — the old codes stop working. Q: Which authenticator apps work with Hugging Face? A: Any app that produces standard time-based codes (TOTP). Hugging Face names Authy, Google Authenticator, Microsoft Authenticator and FreeOTP; the Authenticator extension works the same way and reads the code straight off the Hub’s settings page, so no phone is needed. Q: Can my organization require two-factor authentication? A: Yes, on the Team and Enterprise plans: among the organization’s advanced security settings, admins can require every member to enable two-factor authentication on their own account. Q: What if I lose access to my authenticator? A: At the code prompt, click “Lost access to your two-factor authentication app? Use a recovery code” and enter one of your recovery codes. Without them, contact Hugging Face support — you will be asked to prove the account is yours with another factor, such as an SSH key or a personal access token. Q: Why does Hugging Face say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old code — remove it from the extension, remove two-factor authentication in the Authentication settings, and set it up again. ### ElevenLabs (https://www.authenticator.sh/2fa/elevenlabs — steps checked on 2026-10-07; ElevenLabs's own instructions: https://elevenlabs.io/docs/help-center/account/general/how-do-i-add-two-factor-authentication-2-fa-to-my-account) ElevenLabs two-factor authentication works with any authenticator app, including one in your browser. Open Settings from your profile icon, click “Add Two-Factor Authentication”, scan the QR code from the screen with the Authenticator extension, and finish with “Verify & Enable”. If the QR code does not appear, ElevenLabs says it is usually because you have not logged in recently: log out, log back in, and open Settings again. Turn on two-factor authentication in ElevenLabs: 1. Log in at elevenlabs.io on your computer. 2. Click your profile icon in the top right corner to open the account menu, and select “Settings”. 3. Click “Add Two-Factor Authentication”. 4. ElevenLabs shows a QR code for your authenticator app. 5. Leave the QR code on the screen and add it to the extension as described below — then enter the code from the extension and click “Verify & Enable”. Keep your ElevenLabs backup code: Right after 2FA is turned on, ElevenLabs shows a backup code — one code, shown only this once; you will not be able to see it again. It is what lets you remove 2FA from your account if your authenticator is gone, so copy it somewhere other than this computer before you close the window. Q: Can I use ElevenLabs 2FA without a phone? A: Yes. ElevenLabs asks you to scan the QR code with your preferred authentication app, and any app that supports standard time-based codes (TOTP) will do — including the Authenticator extension, which reads the QR code straight off the ElevenLabs settings page. Q: Does 2FA change how many credits I can buy on ElevenLabs? A: Yes. Without 2FA, Pay As You Go purchases are capped per calendar month — from $100 on the Free, Starter and Creator plans to $2,000 on Business — and Auto Top Up counts toward the cap. Turning on 2FA removes it. Q: What if I lose access to my authenticator? A: Use the backup code you saved during setup — ElevenLabs says it lets you remove 2FA from your account. Its help does not describe a way back without it, so keep the code safe, keep the extension’s automatic backups on, and contact ElevenLabs support if both are gone. Q: Why does ElevenLabs say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set 2FA up again. ### Notion (https://www.authenticator.sh/2fa/notion — steps checked on 2026-10-07; Notion's own instructions: https://www.notion.com/help/two-step-verification) Notion 2-step verification works with any authenticator app, including one in your browser. Open Settings → your name → Account security → Add verification method, choose “Code from authenticator”, and scan the QR code from the screen with the Authenticator extension. Notion offers 2-step verification only to accounts with a password. If you sign in with temporary login codes, set one first: Settings → your name → “Set a password”. If your organization requires login through an identity provider (Okta, Microsoft Azure, Google Workspace), set up the second step there instead. Depending on your region, the authenticator may be the only method offered. On the Enterprise Plan, organization owners can require it of guests, but not of workspace members. Turn on 2-step verification in Notion: 1. Open Notion in Chrome on your computer and sign in. 2. In the sidebar, select the down arrow next to the workspace name, go to “Settings” and select your name. 3. Under “Account security”, select “Add verification method” next to “2-step verification”. 4. Choose “Code from authenticator”. 5. Notion shows a QR code. Leave it on the screen and add it to the extension as described below — then name the method and enter the one-time code from the extension to finish. Save your six Notion backup codes: If the authenticator is your first 2-step method, Notion gives you a set of six backup codes as you finish — save them somewhere other than this computer. Each works once: at the sign-in prompt, click “Try another method” → “Use backup code”. When all six are used up, you can generate a new set in your settings. Q: Which authenticator apps work with Notion? A: Any app that produces standard time-based codes (TOTP) — Google Authenticator, Microsoft Authenticator, Authy, or a browser extension like this one. The Authenticator extension reads the QR code straight off the Notion settings page, so no phone is needed. Q: Can I add more than one authenticator to Notion? A: Yes — up to four verification methods: two authenticators and two phone numbers. Select “Change verification method” next to 2-step verification, confirm with a method that already works, then click “Add authenticator”. A second authenticator is a good way back if you lose the first. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes, then set the authenticator up again. If the codes are gone too, contact Notion support — and keep the extension’s automatic backups on, so a reinstall does not cost you the account. Q: Why does Notion say my code is wrong? A: Usually the computer clock is off by a minute or more. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension, delete that method in Account security, and add it again. ### Kick (https://www.authenticator.sh/2fa/kick — steps checked on 2026-10-09; Kick's own instructions: https://help.kick.com/en/articles/7120898) Kick two-factor authentication works with Google Authenticator and apps like it — including one in your browser. Open kick.com/settings/security, click “Enable 2FA”, scan the QR code from the screen with the Authenticator extension, and confirm with the six-digit code. Turn on two-factor authentication on Kick: 1. Sign in at kick.com on your computer. 2. Open your channel’s security page at kick.com/settings/security. 3. Click “Enable 2FA”. 4. When Kick shows a QR code, leave that page open and add it to the extension as described below — then click “Continue Setup”, enter the six-digit code and click “Continue Setup” again. Kick confirms: “Your account is now protected by Two Factor Authentication”. Keep a way back into Kick: Kick’s help does not mention backup codes. If you lose your authenticator, the way back is Kick support: email support@kick.com from the address linked to your Kick account and ask them to remove 2FA — so keep that email account safe as well. Our advice: Kick also offers the code for manual entry next to the QR code; write it on paper and keep it offline, and keep the extension’s automatic backups on, so a reinstall or a new computer does not send you to support. Q: Can I use a Kick authenticator without a phone? A: Yes. Kick’s help names Google Authenticator, but all Kick asks for is the six-digit code — not which device made it. The Authenticator extension produces the code in Chrome and reads the QR code straight off the Kick security page. Q: Which authenticator app works with Kick? A: Kick names Google Authenticator and lets you scan the QR code or enter the code by hand. Apps that produce the same time-based codes work too — Microsoft Authenticator, Authy, 2FAS, or a browser extension like this one. Q: Do I need 2FA to change my Kick username? A: Yes. Kick’s help says two-factor authentication must be enabled on your account before you can change your username. Turn it on as described above, then go back to the username setting. Q: What if I lose access to my authenticator? A: Email support@kick.com from the email address associated with your Kick account; Kick removes 2FA so you can sign in and set it up again. Keeping the extension’s automatic backups on means a reinstall does not lose the codes in the first place. ### FACEIT (https://www.authenticator.sh/2fa/faceit — steps checked on 2026-10-09; FACEIT's own instructions: https://support.faceit.com/hc/en-us/articles/115000254670-Enabling-2-factor-authentication) FACEIT two-factor authentication works with Google Authenticator and apps like it — including one in your browser. In your account settings select “Edit”, then “Turn On” next to “Two-Factor Authentication”, scan the barcode in the popup with the Authenticator extension, and enter the six-digit code. Turn on two-factor authentication on FACEIT: 1. Sign in at faceit.com on your computer. 2. Open your account settings at faceit.com/en/settings/account. 3. Select “Edit”, then “Turn On” next to “Two-Factor Authentication”. 4. When FACEIT shows a barcode (a QR code) in the popup, leave it open and add it to the extension as described below — then download the backup codes, enter the six-digit code and click “Finish”. Download your FACEIT backup codes: The setup popup offers backup codes before you enter the first code — download them and keep them somewhere other than this computer. FACEIT’s help suggests tattooing them or storing them somewhere safe; the second works too. It does not say how many there are or whether you can make new ones later, so keep the set you get. If you lose both the authenticator and the codes, only FACEIT support can remove 2FA from the account. Q: Can I use FACEIT 2FA without a phone? A: Yes. FACEIT’s help tells you to install Google Authenticator on your phone, but FACEIT only checks the six-digit code. The Authenticator extension produces the same codes in Chrome and reads the barcode straight off the FACEIT popup. Q: Which authenticator app works with FACEIT? A: FACEIT names Google Authenticator. Any app that produces standard time-based codes (TOTP) can scan the same barcode — Microsoft Authenticator, Authy, 2FAS, or a browser extension like this one. Q: I replaced my phone and can’t sign in. How do I get FACEIT to remove 2FA? A: Contact FACEIT support through its request form and give them your FACEIT account name, email address, the first and last name on the account, date of birth, phone number and Steam ID 64 (the number that begins with 76). Once 2FA is removed, turn it on again straight away. With the codes in the extension and its automatic backups on, a new phone does not lock you out at all. Q: Why does FACEIT say my code is wrong? A: Most often the barcode changed: closing and reopening the setup popup makes a new one, and the account you added first no longer matches — add the barcode that is on the screen now. If the extension has two entries for FACEIT, use the newest. And if 2FA was set up earlier in another app, the codes have to come from that app. ### Bethesda.net (https://www.authenticator.sh/2fa/bethesda — steps checked on 2026-10-09; Bethesda.net's own instructions: https://help.bethesda.net/app/answers/detail/a_id/48931) Bethesda.net two-factor authentication — “Enhanced Security” in the account settings — works with Google Authenticator, Microsoft Authenticator and apps like them, including one in your browser. Click your username, open “Enhanced Security”, click “Enable Enhanced Security”, and scan the QR code from the screen with the Authenticator extension. Bethesda’s instructions say the authenticator app needs camera access to capture the QR code. The extension does not need a camera: it reads the QR code straight off the screen. Turn on Enhanced Security on Bethesda.net: 1. Sign in at bethesda.net on your computer. 2. Click your username to open the settings menu, then click “Enhanced Security”. 3. Click “Enable Enhanced Security”, then confirm with the “Enable Enhanced Security” button in the window that appears. 4. When Bethesda.net shows a QR code in that window, leave it open and add it to the extension as described below — then enter the six-digit code in the “Connect your authenticator” window. You are returned to the Enhanced Security screen with a notice that setup was successful. Keep a way back into Bethesda.net: Bethesda’s help article does not describe backup or recovery codes. Once Enhanced Security is on, you can add a phone number for SMS delivery of codes with “Add phone number” — though Bethesda notes a current issue where requesting a code by SMS may give an error, and advises using the app. Our advice: keep the extension’s automatic backups on, so a reinstall or a new computer does not cost you the codes. Q: Can I use Bethesda.net 2FA without a phone? A: Yes. Bethesda’s help assumes an app on a phone, but the account only asks for the six-digit code. The Authenticator extension produces it in Chrome and reads the QR code directly from the Bethesda.net page — no camera needed. Q: Which authenticator app works with Bethesda.net? A: Bethesda names Google Authenticator, LastPass Authenticator, Microsoft Authenticator and Duo Mobile. The QR code is the standard kind, so other apps that produce time-based codes work as well — including a browser extension like this one. Q: Can I get Bethesda.net codes by text message? A: Yes, as an extra: after Enhanced Security is on, click “Add phone number”, enter your mobile number and type in the code Bethesda texts you. Bethesda currently warns that requesting a code by SMS may give an error and recommends the app, so treat SMS as the backup, not the main method. Q: What if I lose access to my authenticator? A: If you added a phone number, request the code by SMS. Otherwise contact Bethesda support at help.bethesda.net — its article does not describe a recovery process of its own. Keeping the extension’s automatic backups on means a reinstall does not put you there. ### Square Enix (https://www.authenticator.sh/2fa/square-enix — steps checked on 2026-10-09; Square Enix's own instructions: https://support.na.square-enix.com/faqarticle.php?kid=82835&id=496&la=1) The Square Enix account’s One-Time Password works with Google Authenticator, Microsoft Authenticator and apps like them — including one in your browser. In the Account Management System open “Services and Options” → “One-Time Password”, choose “Software Authenticator (Google Authenticator, Microsoft Authenticator, etc.)”, and scan the QR code with the Authenticator extension. Square Enix allows one One-Time Password method at a time: if a Security Token (key ring type) or the Square Enix Software Token is already registered, remove it first. New registrations for the Software Token app closed on 21 November 2023 — Square Enix points to the Software Authenticator option instead. Register a Software Authenticator on your Square Enix account: 1. Log in to the Square Enix Account Management System on your computer. 2. Open the “Services and Options” menu and select “One-Time Password”. 3. At the bottom of the One-Time Password page, select “Software Authenticator (Google Authenticator, Microsoft Authenticator, etc.)” and follow the on-screen instructions to the page with the QR code. 4. When Square Enix shows a QR code, leave that page open and add it to the extension as described below — then select “Next” and enter the six-digit one-time password. “Unable to Scan QR Code” shows the authentication key instead. Write down your Emergency Removal Password: Square Enix’s help does not describe backup codes; its way back is the Emergency Removal Password. It is shown on the main page of the Account Management System after you log in — write it down now and keep it away from this computer, because once you cannot log in, you cannot see it either. If you lose your authenticator, the emergency removal page takes that password and removes the Software Authenticator, so you can log in and register it again. Without it, the account holder has to contact the Square Enix Support Center through its form. Q: Do I need the Square Enix Software Token app? A: No. New registrations for the Software Token closed on 21 November 2023. The “Software Authenticator” option takes Google Authenticator, Microsoft Authenticator and similar apps — and the Authenticator extension produces the same six-digit codes in Chrome. Q: Can I use the Square Enix One-Time Password without a phone? A: Square Enix lists a smartphone as a requirement because it expects the app to run on one, but what the account checks is the six-digit code. The extension reads the QR code straight off the Account Management page and makes the codes on your computer. Q: Does it protect my FINAL FANTASY XIV account? A: Yes. The One-Time Password is registered on the Square Enix account your FINAL FANTASY XIV service account belongs to, so once it is on, logging in with that account asks for the six-digit code along with your ID and password. Q: What if I lose access to my authenticator? A: Go to Square Enix’s emergency removal page and enter your Emergency Removal Password to remove the Software Authenticator, then register it again. Without that password, contact the Support Center through its form. Keeping the extension’s automatic backups on means a reinstall does not put you there. ### Wargaming (https://www.authenticator.sh/2fa/wargaming — steps checked on 2026-10-09; Wargaming's own instructions: https://wargaming.net/support/en/products/wot/article/10568/) Wargaming’s Second Factor Authentication works with Google Authenticator, Microsoft Authenticator and apps like them — including one in your browser. In Account Management find “Second Factor Authentication”, click “Enable”, follow the steps on the portal, and add the account to the Authenticator extension. Wargaming needs access to your account email to turn it on, and if a phone number is linked to the account, it confirms the request with a free SMS. Enabling it is free. Turn on Second Factor Authentication at Wargaming: 1. Sign in at wargaming.net on your computer and go to “Account Management”. 2. Find “Second Factor Authentication” and click “Enable”. 3. Follow the steps on the portal — with your account email at hand, and your phone if a number is linked. 4. When Wargaming shows the setup for your authenticator app, leave that page open and add it to the extension as described below. Save your 10 Wargaming backup codes — and the secret key: Turning 2FA on generates ten backup codes. Each works once, and Wargaming emails you whenever one is used. You can view them or make a new set under Account Management → “Second Factor Authentication” → “Settings” → “Backup Codes”, with a code from your authenticator; a new set cancels the old one, and you can make one no more than twice in 15 minutes. Wargaming also tells you to save the secret key of your authenticator — you need it to restore access if you lose the device. Keep both away from this computer. Q: Can I use Wargaming 2FA without a phone? A: Yes. Wargaming’s help speaks of an app on iOS or Android, but the account only checks the code. The Authenticator extension produces it in Chrome on the computer you play on. Q: Which authenticator app works with Wargaming? A: Wargaming names Google Authenticator and Microsoft Authenticator. Apps that produce the same standard time-based codes work as well — Authy, 2FAS, or a browser extension like this one. Q: Does it cover World of Tanks and World of Warships? A: It is set on your Wargaming.net ID — the account you log in to the games with — and Wargaming describes the authenticator as making one-time passwords for logging into your game account and recovering access to it. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes, or restore the authenticator from the secret key you saved. Without either, contact Wargaming Player Support. Wargaming warns that deleting the app after activation loses you access — so do not remove the account from the extension while 2FA is on, and keep the extension’s automatic backups on. ### Minecraft (https://www.authenticator.sh/2fa/minecraft — steps checked on 2026-10-09; Minecraft's own instructions: https://support.microsoft.com/en-us/account-billing/set-up-an-authenticator-app-as-a-two-step-verification-method-2db39828-15e1-4614-b825-6e2b524e7c95) Minecraft has no 2FA setting of its own: Java and Bedrock Edition both sign in with a Microsoft account, and two-step verification is turned on there — with any authenticator app, including one in your browser. Open account.microsoft.com/security → Manage how I sign in → Add a new way to sign in or verify → Use an app, choose “Set up a different Authenticator app”, and scan the QR code with the Authenticator extension. With two-step verification on, you always need two forms of identification — lose one and your password alone will not get you back in, and regaining access can take 30 days. Microsoft recommends having three pieces of security info on the account, such as a backup email address, before you turn it on. Turn on two-step verification for the Microsoft account you play with: 1. Sign in at account.microsoft.com/security on your computer with the Microsoft account you play Minecraft with. 2. Click “Manage how I sign in” to see the ways you prove who you are. 3. Click “Add a new way to sign in or verify” and choose “Use an app”. 4. Microsoft offers its own Microsoft Authenticator. Instead, click “Set up a different Authenticator app” and then “Next”. 5. Microsoft shows a QR code. Leave it on the screen and add it to the extension as described below — or click “I can't scan the bar code” to see a code for manual entry — then enter the code from the extension. 6. Back on “Manage how I sign in”, under “Additional security” → “Two-step verification”, choose “Turn on” and follow the instructions on the screen. Add Minecraft to Authenticator (in place of the usual steps): 1. Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away. 2. Leave the Microsoft account page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”. 3. The account appears in the list with a six-digit code that changes every 30 seconds. Rename it to Minecraft if you like — the name is only for you. 4. Go back to the Microsoft page and type the current code into the confirmation field. If it is about to expire, wait for the next one. 5. Microsoft confirms the app is added. From now on, when signing in to Minecraft asks for a code, click the extension icon and copy it. No QR code, or it will not scan? Click “I can't scan the bar code” on Microsoft’s setup screen, copy the code, and add it in the extension with “Add Account” → “Manual” → “Secret Key”. Generate your Microsoft recovery code: On the same “Manage how I sign in” page, scroll to “Recovery code” and click “Generate a new code”. There is only ever one: generating a new code cancels the previous one, and Microsoft cannot show or download an existing code again. Print it and keep it away from any device you sign in with. If you lose your other methods, the sign-in page asks “Do you have an account recovery code?” — though with two-step verification on, changes can take 30 days to take effect. Q: Does Minecraft have its own 2FA setting? A: No. Minecraft Java and Bedrock both sign in with a Microsoft account, and two-step verification is set on that account at account.microsoft.com. One setting protects both editions — and every other Microsoft service you use with the same account. Q: Do I have to use Microsoft Authenticator? A: No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page — no phone needed. Q: What if I lose access to my authenticator? A: Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups. Q: Why can’t I add a phone number for text message codes? A: Microsoft is phasing out SMS as a sign-in and recovery method for personal accounts, so the option may not appear at all. An authenticator app, a passkey or a backup email address are what it offers instead. ### Xbox (https://www.authenticator.sh/2fa/xbox — steps checked on 2026-10-09; Xbox's own instructions: https://support.microsoft.com/en-us/account-billing/set-up-an-authenticator-app-as-a-two-step-verification-method-2db39828-15e1-4614-b825-6e2b524e7c95) An Xbox account is a Microsoft account, so Xbox 2FA is two-step verification on your Microsoft account — and it works with any authenticator app, including one in your browser. Open account.microsoft.com/security → Manage how I sign in → Add a new way to sign in or verify → Use an app, choose “Set up a different Authenticator app”, and scan the QR code with the Authenticator extension. With two-step verification on, you always need two forms of identification — lose one and your password alone will not get you back in, and regaining access can take 30 days. Microsoft recommends having three pieces of security info on the account, such as a backup email address, before you turn it on. Turn on two-step verification for the Microsoft account behind your Xbox: 1. Sign in at account.microsoft.com/security on your computer with the Microsoft account you use on Xbox. 2. Click “Manage how I sign in” to see the ways you prove who you are. 3. Click “Add a new way to sign in or verify” and choose “Use an app”. 4. Microsoft offers its own Microsoft Authenticator. Instead, click “Set up a different Authenticator app” and then “Next”. 5. Microsoft shows a QR code. Leave it on the screen and add it to the extension as described below — or click “I can't scan the bar code” to see a code for manual entry — then enter the code from the extension. 6. Back on “Manage how I sign in”, under “Additional security” → “Two-step verification”, choose “Turn on” and follow the instructions on the screen. Add Xbox to Authenticator (in place of the usual steps): 1. Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away. 2. Leave the Microsoft account page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”. 3. The account appears in the list with a six-digit code that changes every 30 seconds. Rename it to Xbox if you like — the name is only for you. 4. Go back to the Microsoft page and type the current code into the confirmation field. If it is about to expire, wait for the next one. 5. Microsoft confirms the app is added. From now on, when signing in to Xbox asks for a code, click the extension icon and copy it. No QR code, or it will not scan? Click “I can't scan the bar code” on Microsoft’s setup screen, copy the code, and add it in the extension with “Add Account” → “Manual” → “Secret Key”. Generate your Microsoft recovery code: On the same “Manage how I sign in” page, scroll to “Recovery code” and click “Generate a new code”. There is only ever one: generating a new code cancels the previous one, and Microsoft cannot show or download an existing code again. Print it and keep it away from any device you sign in with. If you lose your other methods, the sign-in page asks “Do you have an account recovery code?” — though with two-step verification on, changes can take 30 days to take effect. Q: Is there a separate Xbox 2FA setting? A: No. Xbox signs in with your Microsoft account, and two-step verification is set on that account at account.microsoft.com. Turning it on there protects your Xbox account together with Outlook, OneDrive and everything else on the same account. Q: Do I have to use Microsoft Authenticator? A: No. Microsoft pushes its own app during setup, but “Set up a different Authenticator app” accepts any app that generates standard codes. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Microsoft page — no phone needed. Q: What if I lose access to my authenticator? A: Verify with another method on the account — a backup email address or a passkey — or use your recovery code, then set the authenticator up again. With two-step verification on, a password alone will not get you back in, and recovery can take 30 days, so keep the recovery code and the extension’s automatic backups. Q: My Xbox 360 says my password is incorrect after I turned on two-step verification. A: Some devices, such as an Xbox 360, cannot ask for a code. For those, create an app password in the Microsoft account’s additional security options and use it instead of your normal password. ### Proton Mail (https://www.authenticator.sh/2fa/proton-mail — steps checked on 2026-10-09; Proton Mail's own instructions: https://proton.me/support/2fa-authenticator-app) Proton Mail two-factor authentication works with any authenticator app, not only Proton Authenticator — including one in your browser. Open Settings → All settings → Account and password, turn on the “Authenticator app” toggle under Two-factor authentication, and scan the QR code from the screen with the Authenticator extension. 2FA is set up once for the whole Proton Account and is available on free and paid plans. After that, every Proton app — Mail, Drive, VPN, Pass — asks for the code when you sign in. Proton also lets you add a security key alongside the authenticator app. Turn on two-factor authentication in your Proton Account: 1. Sign in at account.proton.me on your computer and open “Settings” ⚙️ → “All settings”. 2. Select “Account and password” in the sidebar and scroll to “Two-factor authentication”. 3. Turn on the “Authenticator app” toggle and enter your password to continue. 4. When Proton shows a QR code, leave that page open and add it to the extension as described below. If you would rather type the key, click “Enter key manually instead”. 5. Click “Next”, enter your password and the six-digit code from the extension, and click “Submit”. Save your Proton 2FA recovery codes: Right after you click “Submit”, Proton gives you several one-time recovery codes. Save them somewhere other than this computer: each one signs you in once if you lose your authenticator. Proton’s other way back is a recovery method — a recovery email, phone number or recovery phrase — so check that one is set on your account, and keep the extension’s automatic backups on. Q: Can I use a Proton Mail authenticator without a phone? A: Yes. Proton needs an app that produces standard six-digit codes and does not care which device runs it. The Authenticator extension generates them in Chrome on your computer and reads the QR code straight off the Proton settings page. Q: Do I need Proton Authenticator, or does any app work? A: Any app that supports time-based codes (TOTP) works — Proton recommends its own Proton Authenticator, but Google Authenticator, Microsoft Authenticator or a browser extension like this one take the same QR code. Proton pairs every device with the same QR code or key, so if you want the codes in two apps, add the code to both during setup; adding one later means turning the toggle off and on and setting 2FA up again. Q: What if I lose access to my authenticator? A: Sign in with one of your recovery codes, or with a security key if you added one, then turn the authenticator off and set it up again. Without either, enter your username and password and choose “I don’t have my 2FA device” → “I don’t have my back-up code” to get a code through your recovery email or phone. Still signed in somewhere? “Lost access to your 2FA device?” under Two-factor authentication turns 2FA off with a recovery method. Q: Why does Proton say “Incorrect login credentials” when I enter the code? A: Most often the account in the extension came from an earlier QR code — the setup was started again or the page was reopened — so it no longer matches. Add the QR code that is on the screen now and type its code in straight away; if there are two Proton entries in the extension, use the newest. If you set 2FA up in another app, the codes come from that app until you set it up again here. ### AOL (https://www.authenticator.sh/2fa/aol — steps checked on 2026-10-09; AOL's own instructions: https://help.aol.com/articles/2-step-verification-stronger-than-your-password-alone) AOL 2-step verification works with any authenticator app, including one in your browser. On your Account Security page click “Turn on 2SV” next to 2-Step Verification, choose “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. AOL shows the “Authenticator app” option only on accounts with at least two recovery methods, such as a recovery phone number and email address — add them on the Account Security page first. AOL also says the option is not yet available for all accounts; if you still do not see it, only the phone method is offered for now. Turn on 2-step verification at AOL: 1. Sign in to your AOL Account Security page on your computer. 2. Next to “2-Step Verification”, click “Turn on 2SV”, then “Get started”. 3. Select “Authenticator app” as your method and click “Continue”. 4. When AOL shows a QR code, leave that page open and add it to the extension as described below, then click “Continue”. 5. Enter the code from the extension and click “Done”. Keep a way back into AOL: AOL’s help does not describe backup codes for the authenticator, so the backup has to be on your side. Our advice: keep the extension’s automatic backups on, or export a backup and store it away from this computer, so a reinstall or a new computer does not lock you out. And keep the recovery phone number and email address AOL asked for current on the Account Security page. Q: Can I use an AOL authenticator without a phone? A: Yes. AOL names Google Authenticator, Microsoft Authenticator, LastPass Authenticator and Authy, but any app that produces standard six-digit codes works. The Authenticator extension generates them in Chrome and reads the QR code straight off the Account Security page. Q: Why don’t I see the “Authenticator app” option? A: AOL shows it only when the account has at least two recovery methods — add a recovery phone number and email address on the Account Security page and try again. AOL also says the option is not available for every account yet. Q: My mail program stopped signing in after I turned on 2-step verification. A: Third-party mail apps such as Outlook or Apple Mail cannot ask for a code. On the Account Security page, generate an app password and enter it in the mail program instead of your normal AOL password. Q: What if I lose access to my authenticator? A: AOL’s 2-step verification help does not describe signing in without the code, so plan for it before it happens: with the extension’s automatic backups on, restoring one brings the codes back. If you still have the account open somewhere, you can turn 2-step verification off under “Manage” and set it up again with a new QR code. Otherwise, contact AOL through its help site. ### Snapchat (https://www.authenticator.sh/2fa/snapchat — steps checked on 2026-10-09; Snapchat's own instructions: https://help.snapchat.com/hc/en-us/articles/7012345351700-How-do-I-set-up-Two-Factor-Authentication-2FA-on-Snapchat-with-an-authentication-app) Snapchat two-factor authentication works with any authenticator app, including one in your browser. In the Snapchat app open Settings → My Account → Two-Factor Authentication, select “Authentication App”, and add the QR code or key Snapchat shows to the Authenticator extension. Snapchat’s help describes this setting only in the Snapchat mobile app, so the QR code or key appears on your phone, not on the computer — the steps further down show how to get it into the extension. Snapchat also requires both a mobile number and an email address on the account before you turn it on. Turn on two-factor authentication in Snapchat: 1. Open Snapchat on your phone, tap your Profile icon, then the gear icon ⚙️ to open “Settings”. 2. Under “Shortcuts”, tap “My Account”. 3. Under “Manage My Account”, tap “Two-Factor Authentication”, then “Continue”. 4. Select “Authentication App” as your verification method. 5. If Snapchat offers to set it up automatically with an app on the same phone, choose to set it up manually instead — that is the way to get a QR code or key you can add on the computer. 6. When Snapchat shows the QR code or key, keep that screen open and add it to the extension as described below — then enter the code from the extension in the Snapchat app. Add Snapchat to Authenticator (in place of the usual steps): 1. Install 2FA Authenticator from the Chrome Web Store on your computer and pin it to the toolbar. 2. Keep the QR code open in the Snapchat app on your phone. On the computer, click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR with camera”, and allow the camera when Chrome asks. 3. Hold the phone’s screen up to the computer’s camera until the QR code is read. The account appears in the list with a six-digit code that changes every 30 seconds. 4. Type the current code from the extension into the Snapchat app on your phone. If it is about to expire, wait for the next one. 5. Snapchat confirms that two-factor authentication is on. From now on, when it asks for a code — in the app or on the web — click the extension icon and read it off. Snapchat shows a key instead of a QR code, or no camera on the computer? Copy the key on Snapchat’s setup screen, send it to yourself, and add it in the extension with “Add Account” → “Manual” → “Secret Key” — then delete the message, since the key is as good as the codes themselves. Create your Snapchat Recovery Code: Snapchat does not make a Recovery Code for you — create one in advance: Settings → My Account → Two-Factor Authentication → “Recovery Code” → “Generate Code”, and enter your password. Print it or keep it in a password manager, not in your email. Snapchat offers no support for lost Recovery Codes, and without one you cannot log in if you lose the authenticator. Logging in with it turns two-factor authentication off, so turn it on again afterwards. Q: Which authenticator app works with Snapchat? A: Snapchat names Google Authenticator, Duo, Microsoft Authenticator, Authy, 1Password and LastPass, and any app that produces standard six-digit codes works — including the Authenticator extension in Chrome. It can read the QR code from your phone with the computer’s camera, or take the key Snapchat shows. Q: Can I set up Snapchat two-factor authentication on my computer? A: Snapchat’s help describes the setup only in its mobile app, so you start it there. The codes do not have to stay on the phone, though: once the account is in the extension, it gives you the code in Chrome whenever Snapchat asks for one — on Snapchat for the web or in the app. Q: What if I lose access to my authenticator? A: Log in with your username and password and enter your Recovery Code when asked — that turns two-factor authentication off, so set it up again right away. The code has to have been created in advance, and Snapchat does not help with lost ones. Keeping the extension’s automatic backups on means a reinstall or a factory reset of the phone does not cost you the account. Q: Does Snapchat ask for the code when I reset my password? A: Yes. With two-factor authentication on, Snapchat asks for it at login even after you reset a forgotten password — that is what keeps someone with access to your email or phone number out. Keep your mobile number and email up to date on the account as well. ### Upwork (https://www.authenticator.sh/2fa/upwork — steps checked on 2026-10-09; Upwork's own instructions: https://support.upwork.com/hc/en-us/articles/17980663088659--Use-two-step-security-verification) Upwork two-step verification works with any authenticator app, including one in your browser. Go to Settings → Password & Security, turn on the toggle next to “Authenticator app code”, and scan the QR code from the screen with the Authenticator extension. Upwork lets you turn on several methods at once — an authenticator app, a mobile app prompt, a text message (not to a VoIP number) and a security question — and recommends more than one as a backup. Once one method is on, Upwork asks you to verify with it before you add, edit or turn off another. Turn on the authenticator app in Upwork: 1. Sign in at upwork.com on your computer. 2. Go to “Settings” → “Password & Security”. 3. Turn on the toggle next to “Authenticator app code” and complete two-step verification if Upwork asks for it. 4. When Upwork shows a QR code, leave that page open and add it to the extension as described below — or copy the secret key for manual entry. 5. Enter the six-digit code from the extension and choose “Verify”. Set up a second way to verify on Upwork: Upwork does not hand out backup codes. Its backup is another method: answer a security question, add a phone number for text messages, or turn on the mobile app prompt in the same “Password & Security” settings — when Upwork asks for verification, you can pick any method you have on. Our advice: add at least the security question, and keep the extension’s automatic backups on. Q: Can I use Upwork two-step verification without a smartphone? A: Yes. The authenticator option takes any app that produces standard time-based codes (TOTP), and Upwork does not check which device runs it. The Authenticator extension generates the codes in Chrome on your computer and reads the QR code straight off the Password & Security page. Q: Which authenticator app works with Upwork? A: Upwork names Google Authenticator and says many mostly free apps work, since the codes follow a standard. That includes Microsoft Authenticator, Authy, 2FAS and browser extensions like this one. Q: When does Upwork ask for the code? A: At login, when you open certain parts of the account such as settings or payments, and whenever you add, edit or turn off a verification method. Signing in with face or fingerprint recognition does not replace it: Upwork says those log you in but cannot pass a two-step verification check. Q: What if I lose access to my authenticator? A: Choose another method you turned on — the security question, a text message or the mobile app prompt — then turn the “Authenticator app code” toggle off and on again in Password & Security and add the new QR code. If no method works, contact Upwork Support. ### Vercel (https://www.authenticator.sh/2fa/vercel — steps checked on 2026-10-09; Vercel's own instructions: https://vercel.com/docs/two-factor-authentication) Vercel two-factor authentication works with any authenticator app that makes time-based codes (TOTP) — including one in your browser. Open Account Settings → Authentication, switch on two-factor authentication, choose the authenticator app, and scan the QR code from the screen with the Authenticator extension. Vercel offers two methods: an authenticator app and a passkey, such as a security key or your computer’s fingerprint sign-in. The steps below set up the authenticator app; a passkey can be added alongside it. Turn on two-factor authentication on Vercel: 1. Sign in to Vercel on your computer. 2. Open your account settings and select “Authentication” — or go straight to vercel.com/account/settings/authentication. 3. In the “Two-Factor Authentication” section, toggle the switch to enable 2FA. 4. Choose the authenticator app as your method. 5. When Vercel shows a QR code, leave that page open and add it to the extension as described below — or copy the key Vercel shows for manual entry — then enter the six-digit code from the extension to confirm. Save your Vercel recovery codes: Once 2FA is set up, Vercel prompts you to save your recovery codes. Keep them somewhere other than this computer — they are what gets you into the account if you lose your authenticator. Each code works once, and you can generate a new set at any time in the same Authentication settings. Q: Can I use Vercel 2FA without a phone? A: Yes. Vercel names Google Authenticator as an example, but any app that makes standard time-based codes works — including the Authenticator extension, which reads the QR code straight off the settings page and generates the codes in Chrome. A passkey on your computer is the other method Vercel offers. Q: What if I lose access to my authenticator? A: At the two-factor prompt, use one of your recovery codes, or a passkey if you added one. Then set the authenticator up again and save the new codes. Without either, you have to ask Vercel to recover the account, which means proving it is yours. Q: My Vercel team enforces 2FA. What changes for me? A: Until 2FA is on for your account, you cannot open the team’s resources, your builds for the team fail, and CI tokens tied to your account stop working. Vercel prompts you to set it up when you visit the team dashboard; once it is on, everything works again. Service accounts and bots need 2FA too. Q: Why does Vercel say my code is wrong? A: Usually the QR code changed: if the setup was closed or started again, Vercel made a new one, and the account you added first no longer matches. Remove it from the extension, add the QR code on the screen now and type its code in straight away. If you have two entries for Vercel, use the newest. ### Supabase (https://www.authenticator.sh/2fa/supabase — steps checked on 2026-10-09; Supabase's own instructions: https://supabase.com/docs/guides/platform/multi-factor-authentication) Supabase multi-factor authentication uses a time-based code (TOTP) from any authenticator app — including one in your browser. In the dashboard open Account → Security, click “Add app” under Multi-factor authentication, and scan the QR code from the screen with the Authenticator extension. This protects your own Supabase account. Turning on MFA for the users of an app you build on Supabase is a different setting, in the project’s Auth settings. When you enable MFA, Supabase signs out all your other sessions, and you sign in again with the code. Turn on multi-factor authentication in Supabase: 1. Sign in to the Supabase Dashboard on your computer. 2. Open your account menu and choose “Account”, then select “Security” in the sidebar — or go straight to supabase.com/dashboard/account/security. 3. Under “Multi-factor authentication”, click “Add app”. 4. Type a name you will recognize into “Authenticator app name” and click “Generate QR”. 5. When Supabase shows a QR code, leave that page open and add it to the extension as described below — the key is under “Unable to scan?” — then type the code from the extension into “Authentication code” and click “Confirm”. Supabase has no recovery codes — add a second app: Supabase’s docs say it does not hand out recovery codes, and that it cannot restore access to an account whose every two-factor factor is lost. Its advice is a backup factor: click “Add another app”, which Supabase offers while only one is registered, and scan that second QR code with an authenticator on a different device, such as your phone. Supabase also suggests keeping the secret key somewhere secure, apart from your main authenticator. Keep the extension’s automatic backups on as well. Q: Which authenticator app works with Supabase? A: Any app that makes standard time-based codes. Supabase names 1Password, Authy, Google Authenticator and Apple’s Keychain; the Authenticator extension works the same way and reads the QR code straight off the dashboard, so no phone is needed. Q: What if I lose access to my authenticator? A: Sign in with your second authenticator app, if you registered one, and replace the lost one. Without it there is no way back: Supabase says that for security reasons it will not restore access to an account whose two-factor credentials are all lost. That is why the second app matters. Q: Why can’t I open my organization’s projects? A: The organization requires MFA. Its owner turned on “Require MFA to access organization”, and members without MFA lose access to its projects at once. You are still a member: turn on MFA as described above and your permissions come back. Q: Does this turn on MFA for my app’s users? A: No. These steps protect your own Supabase account, the one you sign in to the dashboard with. MFA for the people who sign in to an app built on Supabase is part of Supabase Auth and is set up separately, in your project. ### GitLab (https://www.authenticator.sh/2fa/gitlab — steps checked on 2026-10-09; GitLab's own instructions: https://docs.gitlab.com/user/profile/account/two_factor_authentication/) GitLab’s “One-time password authenticator” works with any TOTP app, including one in your browser. Go to Edit profile → Access → Password and authentication, select “Register authenticator”, scan the QR code from the screen with the Authenticator extension, and confirm with your password and the six-digit code. Once 2FA is on, your password stops working for Git over HTTPS and the GitLab API — create a personal access token and use it in their place. On a self-managed GitLab run by your company, the screens are the same; open them on that instance instead of GitLab.com. Register an authenticator on GitLab: 1. Sign in to GitLab on your computer. 2. Select your avatar in the upper right corner, then “Edit profile”. 3. In the left sidebar, select “Access” → “Password and authentication”. 4. In the “One-time password authenticator” section, select “Register authenticator”. 5. When GitLab shows a QR code, leave that page open and add it to the extension as described below — the details for manual entry are next to it — then enter your current password and the code from the extension, and select “Register with two-factor app”. Download your GitLab recovery codes: After the code is accepted, GitLab shows your recovery codes. Copy or print them, or select “Download codes” to save gitlab-recovery-codes.txt, and keep them somewhere other than this computer. Each code works once. To get a new set, go to Password and authentication → “Regenerate recovery codes” and enter your password — the old codes stop working. Q: Can I use a GitLab authenticator without a phone? A: Yes. GitLab lists phone apps such as Google Authenticator, Microsoft Authenticator and Authy, but it checks only the six-digit code, and any app that makes standard time-based codes produces it. The Authenticator extension reads the QR code straight off the GitLab page and keeps the codes in Chrome. Q: What if I lose access to my authenticator? A: At the two-factor prompt, select “Recover your account” and enter a recovery code. Lost those too? If you still have an SSH key on the account, run ssh git@gitlab.com 2fa_recovery_codes and confirm with yes to get a fresh set. GitLab Support resets 2FA only for paid GitLab.com accounts (Premium or Ultimate) — on a Free account, losing every method locks you out for good. Q: Why does git push reject my password after turning on 2FA? A: With 2FA on, GitLab no longer accepts your password for Git over HTTPS or the API. Create a personal access token and enter it where Git asks for the password — or push over SSH, which uses your SSH key and is not affected. Q: Why does GitLab say my code is wrong? A: Usually the QR code changed: if you left the page and started registering again, GitLab made a new one, and the account you added first no longer matches. Remove it from the extension, add the QR code on the screen now and type its code in straight away. If you have two entries for GitLab, use the newest. ### Docker Hub (https://www.authenticator.sh/2fa/docker-hub — steps checked on 2026-10-09; Docker Hub's own instructions: https://docs.docker.com/security/authentication/2fa/manage/) Docker’s two-factor authentication works with any authenticator app that supports TOTP — including one in your browser. In your Docker account open Account settings → 2FA, save the recovery code, and scan the QR code from the screen with the Authenticator extension. You need your Docker password and a verified email address on the account. Docker keeps one authenticator per account, and once 2FA is on, the Docker CLI no longer accepts your password for docker login -u, scripts and CI — create a personal access token for those. Turn on two-factor authentication for your Docker account: 1. Sign in to your Docker account at app.docker.com on your computer. 2. Select your avatar in the top-right corner, then select “Account settings”. 3. Select “2FA”, enter your account password, then select “Confirm”. 4. Docker shows your recovery code first. Select “Copy”, or open the menu next to it and select “Download” or “Print”, and keep it somewhere other than this computer. 5. When Docker shows a QR code on the “QR Code” tab, leave that page open and add it to the extension as described below — the key is on the “Text Code” tab — then enter the code from the extension in “Authentication code” and select “Enable 2FA”. Keep your Docker recovery code: Docker gives you one recovery code, shown during setup before the QR code. It signs you in if you lose your authenticator — but only once: using it turns 2FA off and deletes the code, and you turn 2FA on again afterwards. If you lose the code while you can still sign in, open Account settings → “2FA”, confirm your password and select “Generate new code”; the new code replaces the old one. Q: Can I use Docker Hub 2FA without a phone? A: Yes. Docker says any authenticator app that supports TOTP works, and it checks only the six-digit code. The Authenticator extension reads the QR code straight off the Docker page and generates the codes in Chrome — no phone needed. Q: How do I use docker login with 2FA on? A: Run docker login without a username to sign in through the browser, where you enter your password and the code from the extension. For docker login -u, scripts and CI, Docker no longer accepts your password: create a personal access token and enter it at the password prompt. Q: What if I lose access to my authenticator? A: Sign in with your username and password, select “I’ve lost my authentication device” on the Two-Factor Authentication page, and enter your recovery code. That signs you in and turns 2FA off — turn it on again straight away. Without the recovery code, use Docker’s Contact Support form for 2FA lockouts. Q: How do I move Docker 2FA to another authenticator? A: Docker keeps one authenticator per account, so you cannot add a second one. To move to a new app or device, turn 2FA off in Account settings → “2FA” and turn it on again, scanning the new QR code with the app you want to use. ### DigitalOcean (https://www.authenticator.sh/2fa/digitalocean — steps checked on 2026-10-09; DigitalOcean's own instructions: https://docs.digitalocean.com/platform/accounts/2fa/) DigitalOcean two-factor authentication recommends an authenticator app, and any standard one works — including one in your browser. In the Control Panel open My Account → Set Up 2FA, choose the authentication app, scan the QR code from the screen with the Authenticator extension, and add backup codes. 2FA is available only when you log in to DigitalOcean with a username and password. If you log in with Google or GitHub, you manage 2FA in that Google or GitHub account instead. DigitalOcean also asks for a backup method once the main one is set up — choose backup codes, the option it recommends. Turn on two-factor authentication at DigitalOcean: 1. Log in to the DigitalOcean Control Panel at cloud.digitalocean.com on your computer. 2. In the top right corner, click the profile icon, then “My Account”. 3. Scroll to the “Two-factor authentication” section and click “Set Up 2FA”. 4. In the “Set up two factor authentication” window, under “Choose Method”, choose the authentication app. 5. When DigitalOcean shows a QR code, leave that page open and add it to the extension as described below — or click “Try this instead” under it for a code to enter manually — then enter the code from the extension in the field provided. Download your DigitalOcean backup codes: Choose backup codes as your backup method: they appear on the screen, and you can download them as a text file called digitalocean_backupcodes.txt. Keep it somewhere you can reach without this computer. Each code works once; when only a few are left, generate more — the remaining old ones stop working. DigitalOcean recommends backup codes over a second authenticator app, which it offers as a backup only when the main method is SMS. Q: Can I use DigitalOcean 2FA without a phone? A: Yes. DigitalOcean names phone apps such as Google Authenticator, Authy, 1Password, Microsoft Authenticator and Duo, but it checks only the code, and any authenticator that makes standard time-based codes works. The Authenticator extension reads the QR code straight off the Control Panel and keeps the codes in Chrome. Q: What if I lose access to my authenticator? A: Sign in with one of your backup codes — if you cannot find them, search your computer for digitalocean_backupcodes.txt, the file’s default name. If your backup method does not work either, submit a ticket to DigitalOcean support to restore access to your account. Q: I log in to DigitalOcean with Google or GitHub. Where is 2FA? A: In that Google or GitHub account. DigitalOcean’s own 2FA setting is only for logins with a username and password; with Google or GitHub sign-in, turning on 2-Step Verification there protects your DigitalOcean login as well. Q: How do I switch DigitalOcean to a different authenticator app? A: Disable 2FA on the My Account page, then set it up again with the new app — DigitalOcean shows a new QR code. Remove the old DigitalOcean entry from the extension afterwards, so you do not copy a code that no longer works. ### Kraken (https://www.authenticator.sh/2fa/kraken — steps checked on 2026-10-09; Kraken's own instructions: https://support.kraken.com/articles/360000572186-using-an-authenticator-app-for-two-factor-authentication-2fa-) Kraken two-factor authentication works with any authenticator app, including one in your browser. Open Security in your Kraken account, turn on 2FA for signing in — and for funding, if you want a code on every withdrawal — choose “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. Kraken sets up 2FA separately for each action — signing in, funding (deposits and withdrawals), trading, the Master Key and each API key — and funding and trading 2FA need sign-in 2FA on first. Kraken recommends a passkey for signing in and calls an authenticator app “moderately secure”; you can have both, with up to five passkeys and one authenticator app. Turn on authenticator 2FA in Kraken: 1. Sign in to your Kraken account on your computer — at kraken.com or, for Kraken Pro, at pro.kraken.com. 2. Open your “Security” settings. In Kraken Pro, click the profile icon in the upper-right corner, then “Settings” → “Security”. 3. Pick the action to protect. For signing in, go to “Sign-in Two-Factor Authentication (2FA)”; funding, trading and the Master Key each have their own switch further down. 4. Turn the switch on — or choose “Change method” if 2FA is already set up — and select “Authenticator app”. Kraken suggests a passkey first; skip it if codes are what you want. 5. When Kraken shows a QR code, leave that page open and add it to the extension as described below — then enter the code from the extension and click “Confirm”. Keep the Kraken setup key — or set up a Master Key: Kraken hands out no list of backup codes. What restores authenticator 2FA is the setup key — sometimes called the “backup code” — shown as the QR code and as text under “View setup key”. Store it like a password, not digitally, and never share it, not even with Kraken Support. Kraken’s better answer is a Master Key on a different device: Security → “Advanced Settings” → “Enable” next to “Master Key”. It works as a second way to pass sign-in 2FA, but it has to be set up before the authenticator is lost. Funding and trading 2FA need no backup: once you are signed in, you can switch them off and set them up again. Q: Can I use a Kraken authenticator without a phone? A: Yes. Kraken accepts any app that produces standard time-based codes and gives Google Authenticator only as an example. The Authenticator extension reads the QR code straight off the Kraken page and generates the codes in Chrome. Kraken does warn against apps that sync your codes to a Google, Apple or Microsoft account, since that account then becomes a way in. Q: Is 2FA required for withdrawals on Kraken? A: Not by default — funding 2FA is a separate switch. Once it is on, Kraken asks for a code for every withdrawal and for transfers to your Futures wallet. Kraken adds that it is only effective with sign-in 2FA or the Global Settings Lock also on; otherwise whoever gets in can turn it off. API keys work the same way: 2FA is optional for each key, and the Kraken Pro mobile app cannot use API keys that have it. Q: How do I move Kraken 2FA to a new phone or computer? A: While the old authenticator still works, check whether it can export accounts. If not, sign in, add a passkey or security key first, then click “Delete” under “Sign-in Two-Factor Authentication”, click “Enable” and scan the new QR code. If the old device is lost, sign in with your Master Key or the setup key you stored — then change your 2FA at once — or click “Recover account” at the 2FA prompt. Support then removes the 2FA by email and may ask for a photo of you holding your ID and a handwritten note. Q: Why does Kraken say my code is wrong? A: Kraken gives each action its own entry, so check you are reading the right one — when it asks for your Master Key, Kraken says to enter the code labelled “Kraken.com Master Key”, not “Kraken.com Sign-in”. Otherwise the QR code may have changed because the setup page was reloaded or opened again: add the one on the screen now and use the newest entry. If 2FA was first set up in another app, the codes come from that app. ### OKX (https://www.authenticator.sh/2fa/okx — steps checked on 2026-10-09; OKX's own instructions: https://www.okx.com/help/how-do-i-link-an-authenticator-app) OKX works with any authenticator app you prefer — Google Authenticator, Microsoft Authenticator, or one in your browser. On okx.com open Profile → Security, select “Set up” next to “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. OKX asks you to complete email and phone verification before you link an authenticator. Only one authenticator can be linked at a time: linking a new one unlinks the previous one, and OKX pauses withdrawals and P2P trading for 24 hours after the authenticator is changed or reset. Link an authenticator app on OKX: 1. Log in to your account at okx.com on your computer. 2. Go to the security center: “Profile” → “Security”. 3. Under “Authentication methods”, find “Authenticator app” and select “Set up”. 4. OKX asks whether you have an authenticator app — the extension is one, so select “I’ve downloaded one”. 5. When OKX shows a QR code, leave that page open and add it to the extension as described below — then select “Continue”, enter the 6-digit code from the extension and select “Confirm”. Store your OKX setup key: OKX’s help describes no backup codes for the authenticator. What it does say is to store the setup key — the text under the QR code — securely during setup, because if you change or lose your phone you may not be able to log in without it. Keep it on paper, away from this computer and as private as a password: with it you can add the account to any authenticator again. Without it, a lost authenticator has to be reset in the OKX mobile app, and withdrawals pause for 24 hours afterwards. Q: Which authenticator app works with OKX? A: Any of them. OKX names Google Authenticator, Microsoft Authenticator and Authy, and says you can use whichever you prefer. The Authenticator extension produces the same six-digit codes in Chrome and reads the QR code straight off the okx.com security page, so no phone is needed for the setup. Q: Is 2FA required for withdrawals on OKX? A: Yes. OKX uses your verification methods for logins, withdrawals and security changes, and its help says two-factor authentication can’t be turned off — you can change or reset a method, not drop 2FA altogether. After the authenticator is changed or reset, withdrawals and P2P trading are paused for 24 hours. Q: How do I move OKX 2FA to a new phone? A: If the old authenticator still works, go to Profile → Security, select “Change” next to “Authenticator app”, select “Continue” and follow the steps — you pass the usual 2FA check, then scan the new QR code. If you saved the setup key, simply add it to the new app. If the authenticator is lost, reset it in the OKX app: at the verification step select “Unable to verify?” → “Reset authenticator method”, choose the authenticator and confirm with your phone or email; OKX may also ask for facial recognition. On the website, “Unable to verify?” sends you to the app. Q: Why does OKX say my code is wrong? A: Most often the QR code changed because the setup page was reloaded or opened again — and on OKX, linking a new authenticator unlinks the old one. Add the QR code that is on the screen now and use the newest OKX entry in the extension. If you linked the account to another authenticator app before, the codes come from that app. ### Bybit (https://www.authenticator.sh/2fa/bybit — steps checked on 2026-10-09; Bybit's own instructions: https://www.bybit.com/en/help-center/article/How-to-Bind-Your-Account-2FA-via-Google-Authenticator) Bybit calls it Google Authenticator, but its 2FA uses standard codes that any authenticator app produces — including one in your browser. Go to Account → Security, click “Settings” next to Google Two Factor Authentication, and scan the QR code from the screen with the Authenticator extension. Bybit shows the Recovery Key Phrase only once, while you bind — write it down before you click “Confirm”. Bybit’s help names Google Authenticator, but its troubleshooting page speaks of codes from “Google Authenticator or other 2FA apps”, and the extension reads the same QR code. Bind Google Authenticator on Bybit: 1. Sign in at bybit.com on your computer. 2. Hover over the “Profile” icon and click “Account” → “Security”. 3. Click “Settings” next to “Google Two Factor Authentication” — or “Set up Google Authenticator” on the Bybit Protect banner. 4. Enter the verification code Bybit sends to your registered email address or mobile number. 5. When Bybit shows a QR code, leave that page open and add it to the extension as described below — then write down the Recovery Key Phrase, enter the 6-digit code from the extension and click “Confirm”. Write down your Bybit Recovery Key Phrase: The Recovery Key Phrase (RKP) is shown once, at binding, as a QR code or a string of letters and numbers — and Bybit does not keep a copy. It is the key your codes are made from: typed into any authenticator as the key, it brings the codes back on a new device. Bybit suggests encrypted storage or another secured device; keeping it on paper, away from this computer, works just as well. Without the RKP, a lost authenticator has to be unbound through Bybit’s verification, and withdrawals stop for 24 hours afterwards. Q: Do I need Google Authenticator for Bybit? A: No. Bybit’s steps name Google Authenticator, but the codes are the standard time-based kind (TOTP), and Bybit’s own troubleshooting mentions “other 2FA apps”. Any authenticator that scans the QR code works — including the Authenticator extension, which reads it straight off the Bybit page in Chrome, so no phone is needed. Q: How do I move Bybit 2FA to a new phone? A: With the old phone, Google Authenticator can export it: “Transfer accounts” → “Export accounts”, then scan that QR code on the new phone. With your Recovery Key Phrase, add an account manually in the new app and enter the RKP as the key. If you have neither, at sign-in click “Having problems with verification” → “Google Authenticator not working” → “Confirm”, then enter the code Bybit sends to your email and mobile number; Bybit may ask for more by email, with support replying in 1–3 working days. Bind a new authenticator right away. Q: Is 2FA required for Bybit withdrawals and API keys? A: Bybit asks for the 2FA code when you make a withdrawal, and creating an API key — possible only on the Bybit website, not in the app — asks for your Google Authenticator code before the key is made. Disabling or resetting the authenticator locks withdrawals and P2P transactions for 24 hours, so set it up before you need to move funds. Q: Why does Bybit say “Invalid Code”? A: Check that the code comes from the entry for Bybit with your registered email or phone number, not another account. If the QR code changed because the setup page was reloaded or opened again, add the one on the screen now and use the newest entry. If the authenticator was bound in another app, the codes come from that app — and Bybit’s last suggestion is to unbind and bind again. ### KuCoin (https://www.authenticator.sh/2fa/kucoin — steps checked on 2026-10-09; KuCoin's own instructions: https://www.kucoin.com/support/360014897913) KuCoin’s Google 2FA uses standard six-digit codes, so it works with an authenticator in your browser as well as with Google Authenticator. Open your profile → Account Security → Google Verification, select “Configure”, and scan the QR code from the screen with the Authenticator extension. KuCoin calls this “Google 2FA” and its steps name Google Authenticator, but the codes are standard time-based ones, so any authenticator that reads the QR code works. Enter the codes carefully: five wrong ones in a row lock Google 2FA for 2 hours. Turn on Google 2FA on KuCoin: 1. Log in to your KuCoin account at kucoin.com on your computer. 2. Select your profile in the top right and choose “Account Security” → “Google Verification”. 3. Select “Configure” (previously “Bind”). 4. Verify it is you with your passkey, email or text message code — if the passkey fails, click “switch verification method”. 5. When KuCoin shows a QR code, leave that page open and add it to the extension as described below — then enter the 6-digit code from the extension to finish. Save your KuCoin Google security key: KuCoin has no backup codes for Google 2FA. Instead it says to always save your security key — the key shown with the QR code — because it is what lets you relink 2FA yourself when your phone has a problem. Each time you link and unlink the authenticator you get a different key, so keep the latest one. Write it on paper and keep it away from this computer: anyone who has it can produce your codes. Q: Can I use KuCoin Google 2FA without a phone? A: Yes. Despite the name, KuCoin’s Google 2FA is a standard time-based code (TOTP), and any authenticator that scans its QR code produces it. The Authenticator extension reads the QR code straight off the KuCoin page and generates the codes in Chrome. Q: How do I move KuCoin 2FA to a new phone? A: If you saved the security key, delete the old KuCoin entry and add the key to the new authenticator — the codes carry on as before. Without the key, reset it: select “Forgot password” on the login page, click “Google Authenticator unavailable”, choose “Google Authenticator” and complete the verification, which includes identity verification photos — follow the instructions closely or the request may be rejected. If you can still log in, start from “Change” next to Google authenticator in Account Security instead. Q: Is 2FA required for withdrawals on KuCoin? A: Yes — KuCoin requires 2FA for logging in, withdrawing and changing key account settings. Google 2FA is one option; KuCoin also suggests text messages and passkeys, and recommends combinations such as Google 2FA with email verification and a passkey. Withdrawals are disabled for 24 hours after you change your 2FA settings, so do it before you need to move funds. Q: Why does KuCoin say my Google 2FA code is wrong? A: Check that the code comes from the entry for your KuCoin account’s email, and enter it within its 30 seconds. If you linked and unlinked the authenticator, or the setup page was reloaded, there is a new key: add the QR code that is on the screen now and use the newest entry. If 2FA was set up in another app, the codes come from that app. Five wrong codes in a row lock Google 2FA for 2 hours. ### Crypto.com (https://www.authenticator.sh/2fa/crypto-com — steps checked on 2026-10-09; Crypto.com's own instructions: https://help.crypto.com/en/articles/3511439-how-to-set-up-your-crypto-com-exchange-2fa) Crypto.com 2FA uses standard time-based codes, so any authenticator app works — including one in your browser. On the Crypto.com Exchange website go to Profile → Security → Account Password and 2FA, click “Enable 2FA”, and scan the QR code from the screen with the Authenticator extension. These steps are for the Crypto.com Exchange website, where the QR code appears on the computer screen. In the Crypto.com App, 2FA is set up on the phone: Settings → Security → 2-Factor Authentication → Enable 2FA; the app shows the QR code and a button to copy the key, which you can add in the extension with “Add Account” → “Manual” → “Secret Key”. Crypto.com says the App and the Exchange share one 2FA code; the Crypto.com Onchain wallet has its own. Turn on 2FA on Crypto.com: 1. Go to crypto.com/exchange on your computer and select “Log In” in the upper right corner. 2. Go to your Profile and select “Security” → “Account Password and 2FA”. 3. Under “2-Factor Authentication”, click “Enable 2FA”. 4. Copy the key shown next to the QR code somewhere safe — Crypto.com will not show it again. 5. When Crypto.com shows a QR code, leave that page open and add it to the extension as described below — then enter the 6-digit code from the extension and click “Enable 2FA”. Save the Crypto.com 2FA key: Crypto.com gives no backup codes. The key shown during setup is unique to that setup and will not be shown again — and it is what lets you re-bind your account in a new authenticator; without it, 2FA has to be disabled and enabled again. Keep it on paper, away from this computer and as private as a password. Q: Which authenticator app works with Crypto.com? A: Any app that produces standard time-based codes (TOTP). Crypto.com recommends Authy, names Google Authenticator as well, and says it supports various authenticators. The Authenticator extension reads the QR code straight off the Exchange page in Chrome; the codes it shows are numbers only, which is what Crypto.com expects. Q: Can I set up Crypto.com 2FA on my computer? A: On the Exchange, yes — the steps above run in the browser. The Crypto.com App sets up 2FA only on the phone, but the codes do not have to stay there: copy the key the app shows into the extension with “Add Account” → “Manual” → “Secret Key”, or scan the app’s QR code with the computer’s camera using “Add Account” → “QR Code” → “Scan QR with camera”. Q: How do I move Crypto.com 2FA to a new phone? A: If you saved the key, add it manually to the new authenticator. Otherwise reset it in the Crypto.com App: Settings → Security → 2-Factor Authentication → “Reset 2FA”. You confirm with a passkey, or with your passcode and a code from the old authenticator — without either, with your passcode and identity verification — then scan the new code. Resetting the App’s 2FA also resets the Exchange’s, so enable it there again. On the Exchange alone, Crypto.com support asks for a video of you holding your ID and then emails a magic link; withdrawals may be paused for 24 hours. Q: Is 2FA required for withdrawals on Crypto.com? A: On the Exchange, yes: Crypto.com requires 2FA to manage withdrawals, deposits and API keys. In the App, 2FA is something you turn on, and once it is on it becomes mandatory for every transaction type — crypto and fiat withdrawals, whitelisting addresses, gift cards — whenever you use an untrusted device. ### Gemini (https://www.authenticator.sh/2fa/gemini-exchange — steps checked on 2026-10-09; Gemini's own instructions: https://support.gemini.com/hc/en-us/articles/204732985-What-is-two-factor-authentication) Gemini, the crypto exchange, supports authenticator apps for its two-factor authentication — including one that runs in your browser. Open Security Settings on gemini.com, choose the authenticator app, and scan the QR code from the screen with the Authenticator extension, or enter the setup key. Gemini ranks passkeys above authenticator apps and may ask you to create a passkey first; the authenticator app stays a supported method in Security Settings. If you used Authy through Gemini before, that set-up was retired — Authy can be added again like any other authenticator app. Turn on the authenticator app at Gemini: 1. Sign in at gemini.com on your computer. 2. Open the security page at exchange.gemini.com/settings/security — in the mobile app it is the profile icon → “Security Settings”. 3. Find the authenticator app option and start the setup. 4. When Gemini shows a QR code, leave that page open and add it to the extension as described below — or use the setup key Gemini offers in its place. 5. Enter the six-digit code from the extension to confirm the link. Keep a way back into Gemini: Gemini’s help describes no backup codes for the authenticator. Our advice: while the setup key is on the screen, write it down and keep it offline, away from this computer and as private as a password — with it you can add the account to any authenticator again. Adding a passkey as well gives you a second way in. If everything is lost, Gemini’s account recovery asks you to verify the email and phone number on the account and possibly upload an ID or record a selfie, and a successful recovery puts a 72-hour hold on crypto withdrawals. Q: Can I use a Gemini authenticator without a phone? A: Yes. Gemini names Google Authenticator, Duo Mobile and Microsoft Authenticator, but all it checks is the six-digit code, and any standard authenticator (TOTP) produces it. The Authenticator extension reads the QR code straight off the Gemini security page and generates the codes in Chrome. Q: How do I move Gemini 2FA to a new phone? A: If your authenticator app was backed up, Gemini simply appears in it on the new device. If not, Gemini prefers that you change the 2FA setting from the old device while you still have it; otherwise you go through Gemini Support. With the extension, export a backup or restore one of its automatic backups on the new computer and the codes carry on working. Q: What if I lose access to my authenticator? A: Sign in with your email and password and, on the 2FA screen, select “Recover Your Account”. Gemini asks you to verify your email and phone number and may ask for a government ID or a live selfie, then you set up a new passkey or authenticator app. You get three attempts, then a 24-hour wait. If the option does not appear, the account is not eligible for self-service and you need to contact Gemini Support. Q: Is 2FA required for withdrawals on Gemini? A: 2FA is required on every Gemini account and cannot be disabled, and Gemini’s help describes your 2FA method as covering withdrawals as well as sign-ins. After an account recovery, Gemini holds crypto withdrawals for 72 hours. For extra protection Gemini also suggests Withdrawal Protection in your address book. ### Bitget (https://www.authenticator.sh/2fa/bitget — steps checked on 2026-10-09; Bitget's own instructions: https://www.bitget.com/support/articles/12560603821828) Bitget calls its authenticator option “Google Authenticator”, but it uses standard codes that any authenticator app produces — including one in your browser. On the Bitget website open Security, click “Configure” under Google Authenticator, and scan the QR code from the screen with the Authenticator extension. Bitget also sends a six-digit code to your email to finish the setup; it is valid for 10 minutes, so have your inbox open. Turn on Google Authenticator on Bitget: 1. Sign in at bitget.com on your computer. 2. Open the “Security” page (bitget.com/account/setting). 3. Click “Configure” below the Google Authenticator method. 4. When Bitget shows a QR code and a setup key, leave that page open and add it to the extension as described below. 5. Enter the six-digit code from the extension, then click “Send”, enter the code Bitget emails you and click “Confirm”. Save the Bitget backup key: Bitget’s help asks you to save the backup key securely: it is the setup key shown with the QR code, and Bitget calls it essential for recovery if you lose access to your device. Keep it on paper, away from this computer and as private as a password — with it you can add the account to any authenticator again. Without it, a lost authenticator is reset on Bitget’s self-service page (bitget.com/modifyverification). Q: Can I use a Bitget authenticator without a phone? A: Yes. Despite the name “Google Authenticator”, Bitget says you can use other authenticator apps from reliable developers. They all produce the same standard six-digit codes, and the Authenticator extension generates them in Chrome and reads the QR code straight off the Bitget security page. Q: How do I move Bitget 2FA to a new phone? A: If you kept the backup key, add it to the new app or the extension and the codes carry on. Otherwise go to Security, click “Edit” next to Google Authenticator (“Change” in the app) and answer whether the old authenticator is still available: with it, you verify and scan the new QR code; without it, choose “Unbind Google Authenticator” and complete the other verification steps first. Withdrawals and P2P trading are then disabled for 24 hours. Q: What if I lose access to my authenticator? A: Use the backup key to add the account again, or reset the authenticator on Bitget’s self-service page at bitget.com/modifyverification. Keeping the extension’s automatic backups on means a reinstall does not send you there. Q: Is 2FA required for withdrawals on Bitget? A: Once Google Authenticator is on, Bitget asks for its code for withdrawals, at login and for sensitive changes. You can turn it off again, but Bitget advises against it. After the authenticator is changed, withdrawals and P2P trading are disabled for 24 hours. ### MEXC (https://www.authenticator.sh/2fa/mexc — steps checked on 2026-10-09; MEXC's own instructions: https://www.mexc.com/support/article/how-to-link-google-authenticator-on-mexc-17827791508980) MEXC’s “MEXC/Google Authenticator” option uses standard time-based codes, so any authenticator app works — including one in your browser. On mexc.com open Security, click “Enable MEXC/Google Authentication”, and scan the QR code from the screen with the Authenticator extension. MEXC asks you to back up the key before you finish linking: it is what recovers the authenticator if your phone is lost or replaced. You will also need access to the email linked to your account for a verification code. Link Google Authenticator on MEXC: 1. Sign in at mexc.com on your computer. 2. Click the user icon and go to “Security” (mexc.com/user/security). 3. Click “Enable MEXC/Google Authentication”. If MEXC asks you to install an app, click “Next” — the extension is the app. 4. When MEXC shows a QR code and a key, leave that page open and add it to the extension as described below. 5. Click “Get Code” and enter the code MEXC emails you, enter the six-digit code from the extension, and click “Submit”. Back up your MEXC key: MEXC’s help describes no backup codes. Instead it tells you to save the key shown next to the QR code before you complete the linking — it is required to recover the authenticator if your phone is lost or replaced. Keep it on paper, away from this computer and as private as a password. Without it, a lost authenticator goes through MEXC’s security reset, a review that asks for proof that the account is yours. Q: Can I use a MEXC authenticator without a phone? A: Yes. MEXC’s instructions use Google Authenticator or its own MEXC Authenticator, but the codes are standard time-based codes (TOTP) that any authenticator produces. The Authenticator extension generates them in Chrome and reads the QR code straight off the MEXC security page. Q: How do I move MEXC 2FA to a new phone? A: If you backed up the key, add it to the new app or the extension and nothing changes on MEXC. If the authenticator is lost, open Security, choose the authenticator and follow the “Reset Security Verification” link — at sign-in the same link is on the verification screen. With the extension, export a backup or restore one of its automatic backups on the new computer and the codes carry on working. Q: What if I lose access to my authenticator? A: Use “Reset Security Verification” at sign-in or in Security. MEXC asks you to verify your remaining methods and may ask for a questionnaire about your trades and holdings, proof of your funds, a new contact email or phone number, your ID and a video of you holding it; Advanced KYC users can confirm with a face scan instead of codes. Customer Service reviews the request, and once the old authenticator is removed, withdrawals are restricted for 24 hours. Q: Why are my MEXC withdrawals restricted after changing 2FA? A: It is a safety hold: MEXC restricts withdrawals and crypto transfers for 24 hours after Google Authenticator is removed, so someone who took over the account cannot empty it straight away. Set the authenticator up well before you need to move funds. ### Gate (https://www.authenticator.sh/2fa/gate — steps checked on 2026-10-09; Gate's own instructions: https://www.gate.com/help/guide/account/16445/Setup-Two-Factor-Authentication) Gate — the exchange formerly called Gate.io — binds Google Authenticator with a standard secret key, so any authenticator app works, including one in your browser. On gate.com open Profile → Security Center, click “Enable” next to Google Authenticator, and add the key to the Authenticator extension. Only one authenticator can be bound to a Gate account at a time. For security, Gate suspends withdrawals and P2P trading for 24 hours after you bind or unbind Google Authenticator — so set it up well before you need to move funds. Bind Google Authenticator on Gate: 1. Sign in at gate.com on your computer. 2. Click “Profile” in the top-right corner and select “Security Center” from the menu (some Gate pages call it “Security Settings”). 3. Find “Google Authenticator” and click “Enable”. 4. Gate shows a secret key to copy. Leave that page open and add the account to the extension as described below — with the key, or with “Scan QR from screen” if a QR code is shown as well. 5. Back on Gate, enter the six-digit code from the extension, fill in anything else Gate asks for and click “Confirm”. Keep the Gate secret key safe: Gate’s help describes no backup codes for the authenticator. The secret key you copy during setup is what the codes are made from: kept on paper, away from this computer and as private as a password, it lets you add the account to any authenticator again — Gate notes that Google Authenticator and Gate Authenticator both work with the same key. If it is lost too, the way back is Gate’s security reset, reviewed within 24 hours. Q: Can I use a Gate authenticator without a phone? A: Yes. Gate supports Google Authenticator and its own Gate Authenticator, and both work from the same standard secret key — so does any app that produces time-based codes (TOTP). The Authenticator extension generates them in Chrome from the key Gate shows. Q: How do I move Gate 2FA to a new phone? A: If you kept the secret key, add it to the new app or the extension and nothing changes on Gate. If the old authenticator still works, unbind it in Security Center and bind it again with the new key. If it is lost, use “Security Reset” as described below. With the extension, export a backup or restore one of its automatic backups on the new computer and the codes carry on working. Each bind or unbind pauses withdrawals and P2P trading for 24 hours. Q: What if I lose access to my authenticator? A: If you can still sign in, click “Security Reset” (gate.com/securityreset), complete the identity verification and submit the unbinding request; Gate reviews it within 24 hours and emails the result. If you cannot sign in, the reset has to start in the Gate app: tap “unable to verify?” on the verification code screen. The website does not accept reset requests without a login. Q: Why are my Gate withdrawals suspended after setting up 2FA? A: It is Gate’s safety hold: withdrawals and P2P trading are suspended for 24 hours after Google Authenticator is bound or unbound, and after other security changes such as a new phone number, email or password. The hold lifts by itself. ### Netlify (https://www.authenticator.sh/2fa/netlify — steps checked on 2026-10-09; Netlify's own instructions: https://docs.netlify.com/manage/accounts-and-billing/user-settings/#enable-two-factor-authentication-2fa) Netlify two-factor authentication works with any authenticator app, including one in your browser. Open User settings → Security → Two-factor authentication, select “Enable two-factor authentication”, and scan the QR code from the screen with the Authenticator extension. 2FA belongs to your Netlify user, not to a team, so you set it up once in your personal user settings and it covers every team and organization you belong to. Turn on two-factor authentication on Netlify: 1. Sign in to Netlify at app.netlify.com on your computer. 2. Open your “User settings”, then “Security” → “Two-factor authentication” — or go straight to app.netlify.com/user/security. 3. Select “Enable two-factor authentication”. 4. When Netlify shows a QR code, leave that page open and add it to the extension as described below — or copy the code under “Manual entry” — then enter the six-digit code from the extension and select “Next: Recovery codes”. Save your Netlify recovery codes — they are shown once: Right after the code is accepted, Netlify shows your recovery codes. Copy or print them now: Netlify presents them only once, so this is your one chance. Keep them somewhere other than this computer, then select “Finished! I saved my recovery codes.” Each code works once, in place of the code from your authenticator. Q: Can I use Netlify 2FA without a phone? A: Yes. Netlify’s steps assume an app on your phone, but all it checks is the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Netlify settings page and generates the codes in Chrome. Q: Which authenticator app works with Netlify? A: Netlify names 1Password, Authy, Duo and Google Authenticator as examples, and any app that makes standard time-based codes works the same — including the Authenticator extension. Your company may ask you to use a particular one. Q: My Netlify team requires 2FA. What does that mean for me? A: An owner on a Pro plan or higher has set the team or organization to “Encouraged” — you see a banner — or “Enforced”, which keeps you out of its sites until 2FA is on for your Netlify user. Developers, owners, reviewers, publishers and billing admins all need it; Git Contributors, who have no Netlify login, do not. Q: What if I lose access to my authenticator? A: Sign in with one of your recovery codes, then set the authenticator up again. Netlify’s docs describe no way back without them, so if the codes are gone too, contact Netlify support. Keeping the extension’s automatic backups on means a reinstall does not cost you the account. ### Namecheap (https://www.authenticator.sh/2fa/namecheap — steps checked on 2026-10-09; Namecheap's own instructions: https://www.namecheap.com/support/knowledgebase/article.aspx/10073/45/how-can-i-use-the-totp-method-for-twofactor-authentication/) Namecheap’s TOTP two-factor authentication works with any authenticator app, including one in your browser. Open Profile → Security → Access → Two-Factor Authentication, enable the authentication app (TOTP) method, and scan the QR code from the screen with the Authenticator extension. Namecheap allows one 2FA method at a time: if you already use a security key (U2F), switching to the authenticator app replaces it, and Namecheap asks you to confirm the change. Unlike most sites, it shows your backup codes before the QR code. Turn on TOTP two-factor authentication at Namecheap: 1. Sign in to your Namecheap account on your computer. 2. Select “Profile” on the left, then “Security”. 3. In the “Access” section, open “Two-Factor Authentication” and click “Enable” for the authentication app (TOTP). 4. Enter your Namecheap password and click “Continue”. 5. Namecheap shows your TOTP backup codes first. Print or copy them, then click “Next”. 6. When Namecheap shows a QR code, leave that page open and add it to the extension as described below — or click “enter this text code” for the key — then type the six-digit code from the extension and click “Next”. Keep your Namecheap TOTP backup codes: The backup codes Namecheap shows during setup start working once setup is complete, and each works once. At sign-in, “Want to use a Backup Code?” lets you use one instead of the code from your authenticator. Namecheap suggests keeping them in a password manager — somewhere other than this computer. “Show Backup Codes” in the same settings shows which are left (used ones are greyed out), and “Regenerate Backup Codes” gives you a new set and cancels the old one. Q: Can I use Namecheap 2FA without a phone? A: Yes. Namecheap’s guide speaks of an app on your mobile device, but its TOTP method works with any TOTP app, and all it checks is the six-digit code. The Authenticator extension reads the QR code straight off the Namecheap page and generates the codes in Chrome. Q: Which authenticator app works with Namecheap? A: Namecheap names Google Authenticator, Authy and LastPass Authenticator, and says any TOTP-based app works — including the Authenticator extension. Q: Can I have Namecheap codes on my phone and my computer? A: Yes — Namecheap lets you connect as many devices as you like. During setup, scan the same QR code with each one before you click “Next”; they all show the same code. Adding a device later means regenerating the QR code, which also replaces your backup codes and signs you out everywhere. Q: What if I lose access to my authenticator? A: Click “Want to use a Backup Code?” at sign-in and use one of your backup codes. Then regenerate the QR code under Profile → Security → Access → Two-Factor Authentication: the old one stops working, and you add the new one to the extension. Namecheap may lock the account after several wrong codes, so switch to a backup code rather than guessing. ### Bitbucket (https://www.authenticator.sh/2fa/bitbucket — steps checked on 2026-10-09; Bitbucket's own instructions: https://support.atlassian.com/bitbucket-cloud/docs/enable-two-step-verification/) Bitbucket two-step verification works with any TOTP authenticator app, including one in your browser. Open the Settings cog → Personal Bitbucket settings → Two-step verification, select “Set up two-step verification”, and scan the QR code from the screen with the Authenticator extension. This is Bitbucket’s own setting, separate from the two-step verification of your Atlassian account: if both are on, you are asked for the Atlassian code first and then for Bitbucket’s, and each code works only for its own prompt. Before you start, Bitbucket needs a confirmed email address and a password on your Atlassian account, plus an SSH key — with two-step verification on, Git has to reach your repositories over SSH, and Git clients and build tools must use SSH or a token instead of your password. Turn on two-step verification in Bitbucket: 1. Sign in to bitbucket.org on your computer. 2. Select the Settings cog, then “Personal Bitbucket settings”. 3. Under “Security”, select “Two-step verification”, and review the requirements Bitbucket lists. 4. Enter your Atlassian account password, then select “Set up two-step verification”. 5. When Bitbucket shows a QR code, leave that page open and add it to the extension as described below — or copy the key from the “Key” field — then enter the code from the extension in the “Verification code” field. Save your six Bitbucket recovery codes: The last step of setup gives you six recovery codes: download them, and Bitbucket suggests printing a copy too, as a last resort. Keep them somewhere other than this computer. Each code works once, typed into the “Verification code” field like a normal code. Keep at least two unused — you need two to generate new codes or to turn two-step verification off. “Show recovery codes” on the Two-step verification page shows them again. Atlassian cannot turn off Bitbucket two-step verification for you, which makes these codes the way back. Q: Is Bitbucket two-step verification the same as my Atlassian account’s? A: No. Your Atlassian account, which also signs you in to Jira, Confluence and Trello, has its own two-step verification, and Bitbucket Cloud has a second one of its own. With both on, you enter two codes from two different entries in the extension — use the Bitbucket entry at the Bitbucket prompt. Atlassian also asks for a different backup: one emergency recovery key instead of six recovery codes. Q: Which authenticator app works with Bitbucket? A: Bitbucket names Authy, Google Authenticator, Duo and Microsoft Authenticator, and accepts any app that supports TOTP, on a phone or a desktop. The Authenticator extension reads the QR code straight off the Bitbucket page and generates the codes in Chrome — no phone needed. Q: Why did git push stop working after I turned on two-step verification? A: With two-step verification on, Bitbucket expects Git to reach your repositories over SSH — cloning, pushing, pulling and fetching. Add an SSH key to your account and switch your repositories’ remotes to their SSH addresses; tools that cannot use SSH need a token instead of your password. Q: What if I lose access to my authenticator? A: Enter a recovery code in the “Verification code” field, then turn two-step verification off and on again to add the new QR code. Without codes, select “Forgot code” at the prompt and “Send recovery email”: Bitbucket emails you first, waits 24 hours — a delay that cannot be shortened — and then sends a one-time login link that expires 24 hours later, so check your inbox and spam folder in time. ### Hetzner (https://www.authenticator.sh/2fa/hetzner — steps checked on 2026-10-09; Hetzner's own instructions: https://docs.hetzner.com/general/security-and-identify/two-factor-authentication/) Hetzner two-factor authentication works with a standard authenticator app, including one in your browser. In Hetzner Accounts open Settings → Two-factor authentication → Enable 2-FA, save your recovery key, add the “Mobile Device” method and scan its QR code from the screen with the Authenticator extension. Hetzner asks you to save a recovery key before you add any method, and warns that a lost key can only be replaced by regular mail. Have somewhere safe to note it down before you begin. Turn on two-factor authentication at Hetzner: 1. Sign in to Hetzner Accounts at accounts.hetzner.com on your computer. 2. Under “Settings”, open “Two-factor authentication” and click “Enable 2-FA”. 3. Enter your account password and confirm that a lost recovery key can only be replaced by regular mail. 4. Hetzner shows your customer number and recovery key. Note the key down and keep it somewhere safe, then click “Set up authentication”. 5. Under “Add new method”, choose “Mobile Device”. 6. When Hetzner shows a QR code, leave that page open and add it to the extension as described below — then fill in the fields Hetzner asks for, including the code from the extension, and confirm. Keep your Hetzner recovery key: Hetzner gives you one recovery key instead of a list of backup codes. If signing in with a code fails, click the red “Disable 2FA” option under “Verify” and enter the key: you get into your account, and two-factor authentication is switched off until you set it up again. Write the key down and keep it somewhere other than this computer — replacing it means a manual review and a new key by regular mail. Q: Can I use Hetzner 2FA without a phone? A: Yes. The method is called “Mobile Device”, but Hetzner only checks the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the Hetzner page and generates the codes in Chrome. Q: Can I add more than one 2FA method to Hetzner? A: Yes. Hetzner lets you add several methods and keep them active at once — for example the extension and an authenticator on your phone, or a YubiKey — and you can sign in with any of them. A second method is a good way back if you lose the first. Q: What if I lose access to my authenticator? A: Sign in with another active method if you added one, or click “Disable 2FA” under “Verify” and enter your recovery key, then set the authenticator up again. Without the key, request a new one with Hetzner’s recover-access form at accounts.hetzner.com/recover_access: you need your full customer number — it starts with “K” and is in the top right-hand corner of your last invoice — and an email address where Hetzner can reach you. Q: Why does Hetzner say my code is wrong? A: Usually the QR code changed: if the setup page was reloaded or opened again, Hetzner made a new one, and the account you added first no longer matches. Add the QR code that is on the screen now and type its code in straight away. If you have two Hetzner entries in the extension, use the newest. ### Twilio (https://www.authenticator.sh/2fa/twilio — steps checked on 2026-10-09; Twilio's own instructions: https://help.twilio.com/articles/360046874054-Setup-Twilio-two-factor-authentication-2FA-in-a-TOTP-Authenticator-app) Twilio’s two-factor authentication works with any TOTP authenticator app, not only its own Authy — including one in your browser. In the Twilio Console open User Settings → Two-factor authentication (2FA) → Edit → “+ Add authentication app”, and scan the QR code from the screen with the Authenticator extension. Twilio’s help describes these screens for what it calls the legacy Twilio Console, so labels may differ slightly. If you sign in to Twilio through your company’s single sign-on, Twilio’s 2FA is not used for you. Twilio SendGrid and Twilio Segment have logins of their own, with their own 2FA settings. Add an authenticator app to your Twilio login: 1. Sign in to the Twilio Console on your computer. 2. Open “User Settings” — or go straight to console.twilio.com/user/user-settings/overview. Twilio emails you a verification code: enter it and click “Verify”. 3. In the “Two-factor authentication (2FA)” section, click “Edit”. 4. Click “+ Add authentication app” at the top right. 5. When Twilio shows a QR code, leave that page open and add it to the extension as described below — then follow the instructions on the screen and click “Verify and save”. Keep your Twilio recovery code: When you turn on 2FA for the first time, Twilio shows one emergency recovery code, with an option to download it as a file. Store it somewhere other than this computer — Twilio suggests a password manager — because it is not shown again. If you already had 2FA by text message, your existing code still stands; if you have lost it, click “Generate new code” in User Settings, which cancels the old one. Each time you sign in with the code, Twilio gives you a new one to save. Q: Do I need Authy for Twilio 2FA? A: No. Twilio recommends its own Authy app, but says its 2FA works with any authenticator app that follows the TOTP standard, and names apps from Google and Microsoft. The Authenticator extension reads the QR code straight off the Console and generates the six-digit codes in Chrome — no phone needed. Q: Can I turn off two-factor authentication on Twilio? A: No — Twilio’s help calls 2FA a required security feature that can’t be disabled. What you can change is the method: text message, voice call or an authenticator app. Once 2FA is on, you can also switch between methods at the code prompt with “Try another method”. Q: What if I lose access to my authenticator? A: At the code prompt choose “Try another method” → “Recovery code”, enter it and save the new one Twilio gives you; a text message or voice call works too if your number is still on the account. Owners of upgraded accounts can reset 2FA through the “Reset MFA” web form after verifying their account details. With no code at all, submit a request through Twilio’s Help Center with your email address and Account SID. In an organization, an admin can reset 2FA for managed users. Q: Why does Twilio say my code is wrong? A: Usually the QR code changed: if the setup was closed or started again, Twilio made a new one, and the account you added first no longer matches. Add the QR code that is on the screen now and type its code in straight away. If you have two Twilio entries in the extension, use the newest. ### n8n (https://www.authenticator.sh/2fa/n8n — steps checked on 2026-10-09; n8n's own instructions: https://docs.n8n.io/administer/manage-users-and-access/verify-user-identity/require-two-factor-auth) n8n two-factor authentication works with any authenticator app, including one in your browser — on n8n Cloud and self-hosted alike. Open Settings → Personal, select “Enable 2FA”, and scan the QR code from the screen with the Authenticator extension. 2FA is set up per n8n instance: if you use several — a Cloud workspace and your own server, say — turn it on in each. It applies to signing in with email and password; if you sign in through your company’s single sign-on (SAML or OIDC), the second step is up to that login instead. On a self-hosted instance, an admin can turn 2FA off for everyone with N8N_MFA_ENABLED=false, but n8n ignores that while any user has 2FA on. Turn on two-factor authentication in n8n: 1. Sign in to your n8n instance — your n8n Cloud workspace or your self-hosted n8n — in Chrome on your computer. 2. Go to “Settings” → “Personal”. 3. Select “Enable 2FA”. 4. When n8n shows a QR code, leave that window open and add it to the extension as described below — then enter the code from the extension in “Code from authenticator app” and select “Continue”. Save your n8n recovery codes: After you select “Continue”, n8n displays your recovery codes. Save them somewhere other than this computer — they are what gets you back into the account if you lose your authenticator. n8n’s docs do not say how many there are or how to see them again, so save the whole list the moment it appears. Q: Can I use n8n 2FA without a phone? A: Yes. n8n’s docs mention an app on your phone, but all n8n checks is the code, and any standard authenticator produces it. The Authenticator extension reads the QR code straight off the n8n settings and generates the codes in Chrome. Q: Can an admin make 2FA mandatory in n8n? A: Yes, on n8n Cloud Enterprise and on self-hosted Business and Enterprise plans: Settings → Security → “Enforce two-factor authentication”. Everyone who signs in with email and password must then set up 2FA before continuing — those who have not are prompted at their next sign-in. Users signing in through SAML or OIDC single sign-on are not affected. Q: What if I lose access to my authenticator? A: Sign in with one of your recovery codes, then set 2FA up again. On a self-hosted instance, if the codes are gone too, an admin with access to the server can run n8n mfa:disable --email=you@example.com, with your email address, and you set 2FA up again at your next sign-in. On n8n Cloud there is no such command for you to run — contact n8n support. Q: Why does n8n say my code is wrong? A: Usually the QR code changed: if the 2FA window was closed or opened again, n8n made a new one, and the account you added first no longer matches. Add the QR code that is on the screen now and type its code in straight away. If you have two entries for the same n8n instance, use the newest. ### Microsoft 365 (https://www.authenticator.sh/2fa/microsoft-365 — steps checked on 2026-10-09; Microsoft 365's own instructions: https://support.microsoft.com/en-us/account-billing/set-up-your-security-info-from-a-sign-in-prompt-28180870-c256-4ebf-8bd7-5335571bf9a8) A Microsoft 365 work or school account can take codes from an authenticator app other than Microsoft Authenticator — including one in your browser — if your organization allows it. Open mysignins.microsoft.com → Security info → Add sign-in method → Microsoft Authenticator, click “I want to use a different authenticator app”, and scan the QR code from the screen with the Authenticator extension. This guide is for the account your employer or school gives you (Microsoft Entra ID, formerly Azure AD). A personal Microsoft account — Outlook.com, Hotmail, Xbox — is set up at account.microsoft.com instead and has its own guide. Your organization’s administrator decides which methods you see: if “I want to use a different authenticator app” is missing, third-party authenticator apps are not allowed for your account, and Microsoft Authenticator’s push approvals only work in Microsoft Authenticator. If your organization signs you in through another system (Okta, Duo), the second step belongs to that system. Add an authenticator app to your Microsoft 365 account: 1. Sign in to the Security info page of your work or school account at mysignins.microsoft.com/security-info on your computer. If you are asked for “More information required” right after signing in, select “Next” — the “Keep your account secure” wizard offers the same choice as step 4. 2. Select “Add sign-in method”. 3. Choose “Microsoft Authenticator” and select “Add”. Some organizations’ pages list it as “Authenticator app”. 4. Microsoft suggests downloading its own app. Instead, select “I want to use a different authenticator app”, then “Next”. 5. When Microsoft shows a QR code, leave that page open and add it to the extension as described below — or select “Can't scan image?” to see a key for manual entry. Then select “Next” and enter the six-digit code from the extension. Add a second sign-in method: Microsoft’s help for work or school accounts describes no backup codes. Your way back is a second method on the Security info page — a phone number, a second authenticator, or whatever else your organization offers — and, failing that, your IT help desk, which can make you register your methods again. Microsoft allows up to five authenticator apps and hardware tokens per account, so a second copy of the codes is possible; the extension’s automatic backups cover a reinstall. Q: Do I have to use Microsoft Authenticator for my work account? A: Not if your organization allows other apps. The setup screens push Microsoft Authenticator, but “I want to use a different authenticator app” accepts any app that generates standard six-digit codes, and the Authenticator extension reads the QR code straight off the Security info page. If your organization requires push notifications with number matching, those exist only in Microsoft Authenticator. Q: Why is there no “I want to use a different authenticator app” option? A: Your organization’s administrator has not allowed third-party authenticator apps (Microsoft calls them software OATH tokens) for your account, or limits you to certain methods. Only the administrator can change that — ask your IT help desk which methods you may use. Q: What if I lose access to my authenticator? A: Sign in with another method you added on the Security info page, delete the old authenticator there and add the new one. If you have no other method, your IT help desk can reset your sign-in methods so you can register again. With the extension, restoring one of its automatic backups on a new computer keeps the same codes working. Q: Is this the same as my personal Microsoft account? A: No. A work or school account is managed by your organization at mysignins.microsoft.com; a personal Microsoft account — Outlook.com, Hotmail, Xbox, a personal OneDrive — is managed by you at account.microsoft.com. Each has its own authenticator setup, and the extension can hold both as separate entries. ### Login.gov (https://www.authenticator.sh/2fa/login-gov — steps checked on 2026-10-09; Login.gov's own instructions: https://login.gov/help/create-account/authentication-methods/authentication-application/) Login.gov accepts any authentication app that generates six-digit codes — its own help lists Chrome extensions among them. Sign in at secure.login.gov, select “Enable” next to “Authentication app”, and scan the QR code from the screen with the Authenticator extension. Creating a new account? After your password, Login.gov asks you to set up a second layer of security — choose “Authentication application” there and continue from step 4. Login.gov does not let you turn the second step off, and it recommends having at least two authentication methods, because it cannot restore access if you lose your only one. Add an authentication app to Login.gov: 1. Sign in to your Login.gov account at secure.login.gov on your computer with your email, password and current authentication method. 2. On your account page, look through the “Your authentication methods” menu on the left. 3. Select “Enable” next to “Authentication app”. Login.gov may ask for a nickname for the app — any name works. 4. When Login.gov shows a QR code, leave that page open and add it to the extension as described below — or copy the code shown for manual entry. Then enter the six-digit code from the extension to finish. Add a second method, or Login.gov backup codes: Login.gov cannot let you back in if you lose every authentication method: you would have to delete the account and create a new one, which takes a 24-hour waiting period. So add a second method on the account page — a phone number, a security key, face or touch unlock — or backup codes: a set of ten single-use codes, with a new list offered when the tenth is used. Login.gov calls backup codes the least secure option and warns against using them as your only method; print or write them down and keep them away from this computer. Q: Can I use Login.gov’s authentication app option without a phone? A: Yes. Login.gov’s help says to choose a device “such as a computer or mobile device”, and lists Windows and Mac apps and Chrome extensions alongside phone apps. The Authenticator extension reads the QR code straight off the Login.gov page and generates the codes in Chrome. Q: Which authentication app works with Login.gov? A: Any app that produces the standard six-digit codes. Login.gov names Google Authenticator, Authy, 1Password, LastPass and others as examples, and none of them should cost anything — if an app charges you for codes, Login.gov says it is likely a scam app. Q: What if I lose access to my authenticator? A: Sign in with your other authentication method, then remove the lost one under “Manage” on your account page and add the authenticator again. If it was your only method, Login.gov cannot unlock the account: you have to delete it (after a 24-hour wait) and create a new one. What you saved with the agencies is not lost, but you reach it through the new account. Keeping the extension’s automatic backups on means a reinstall does not lose the codes. Q: Can I stop Login.gov from asking for a code every time? A: You cannot turn the second step off, but you can tick “Remember this browser” when you enter a code. Login.gov then skips the code in that browser for up to 30 days — less if you clear cookies, update the browser or use a private window. ### Salesforce (https://www.authenticator.sh/2fa/salesforce — steps checked on 2026-10-09; Salesforce's own instructions: https://help.salesforce.com/s/articleView?id=xcloud.add_time-based_token.htm&type=5) Salesforce multi-factor authentication accepts any authenticator app that supports TOTP, not only Salesforce Authenticator — including one in your browser. In your personal settings open Advanced User Details, click “Connect” next to “App Registration: One-Time Password Authenticator”, and scan the QR code from the screen with the Authenticator extension. Your Salesforce administrator decides how your organization signs in. If you sign in through your company’s own login (Okta, Microsoft Entra ID, Google), the second step belongs to that system, not to Salesforce. Salesforce emails you whenever a new verification method is added to your account. Connect an authenticator app to Salesforce: 1. Sign in to Salesforce on your computer and open your personal settings — click your profile picture and choose “Settings”. 2. In the Quick Find box, enter “Advanced User Details” and select it. If nothing comes up, search for “Personal Information” instead. 3. Find “App Registration: One-Time Password Authenticator” and click “Connect”. Salesforce may ask you to log in again first. 4. When Salesforce shows a QR code, leave that page open and add it to the extension as described below — or click “I Can't Scan the QR Code” to see a key for manual entry. Then type the code from the extension into “Verification Code” and click “Connect”. Plan a way back into Salesforce: Salesforce does not give users backup codes. If you lose your authenticator, your Salesforce administrator can generate a temporary verification code for you — it works for 1 to 24 hours, as the admin sets — and disconnect the old app, so that Salesforce asks you to register a new method at the next login. Salesforce recommends registering more than one verification method; the extension’s automatic backups keep a reinstall from costing you the codes. Q: Do I have to use Salesforce Authenticator? A: No. Salesforce Authenticator adds push approvals, but Salesforce accepts codes from any authenticator app that supports TOTP — Google Authenticator, Microsoft Authenticator, Authy, or the Authenticator extension in Chrome, which reads the QR code straight off the Salesforce page. Q: Salesforce keeps asking me to approve on Salesforce Authenticator. How do I use the code? A: Salesforce offers your methods in a fixed order — Salesforce Authenticator first, then built-in authenticators and security keys, then third-party authenticator apps. If Salesforce Authenticator is also connected, choose the option to use a different verification method on the login screen and enter the code from the extension. Q: What if I lose access to my authenticator? A: Use another verification method if you registered one. Otherwise ask your Salesforce administrator for a temporary verification code and to disconnect the lost authenticator; at your next login Salesforce asks you to connect a new one. Restoring the extension’s automatic backups on a new computer keeps the same codes working. Q: Can I use Salesforce MFA without a phone? A: Yes. Salesforce’s help says you can install a third-party authenticator app on your mobile device or computer, and that a desktop app can take the key instead of the QR code. The Authenticator extension does either in Chrome, on the computer you already use for Salesforce. ### Gusto (https://www.authenticator.sh/2fa/gusto — steps checked on 2026-10-09; Gusto's own instructions: https://support.gusto.com/article/106622317100000/Set-up-and-manage-2-step-verification) Gusto recommends an authenticator app for 2-step verification, and any standard one works — including one in your browser. Click your name → Settings → Security, click “Set up” next to “Authenticator app”, and scan the QR code from the screen with the Authenticator extension. Your Gusto account is tied to your email, not to each employer: one login and one 2-step verification cover every company you work for in Gusto. Admins find the setting under Settings → My profile instead. Gusto Retirement has a separate login with its own setup. Turn on 2-step verification with an authenticator app in Gusto: 1. Sign in to Gusto at app.gusto.com on your computer. 2. Click your name in the top-right corner, then “Settings”. 3. Under “Personal”, click “Security”. Admins: click “Settings”, then “My profile”. 4. In the “2-step authentication” section, click “Set up” next to “Authenticator app”, pick “Authentication app” as your method and click “Continue”. 5. When Gusto shows a QR code, leave that page open and add it to the extension as described below — the setup key below the QR code works for manual entry, and the icon next to it copies it. Then click “Confirm”. Gusto has no backup codes — set up a second way in: Gusto does not offer backup codes. To avoid a lockout, Gusto recommends adding a passkey as well as your authenticator, and in the same “2-step authentication” section you can add “Photo ID backup”, so Gusto can verify you with your ID if you ever cannot sign in. Without either, the way back is verifying your identity with a government-issued photo ID and a selfie, or calling Gusto. The extension’s automatic backups keep a reinstall from costing you the codes. Q: Can I use a Gusto authenticator without a phone? A: Yes. Gusto’s own help has instructions for setting up a desktop authenticator app on your computer by copying the setup key. The Authenticator extension can take that key or read the QR code straight off the Gusto page, and gives you the code in Chrome whenever Gusto asks. Q: Which authenticator app works with Gusto? A: Any app that generates standard six-digit codes. Gusto names Google Authenticator for phones and Zoho OneAuth for computers as examples; the Authenticator extension works the same way in Chrome. Q: What if I lose access to my authenticator? A: Sign in with a passkey if you added one. Otherwise, on the screen that asks for your code, click “Need help with 2-step verification?” and verify your identity with a photo ID and a selfie; if that does not work, call Gusto. Once you are in, set up the authenticator again under Settings → Security. Q: Do I have to enter a Gusto code every time I sign in? A: Not on a device you trust: tick “Remember this device” when you enter the code, and Gusto asks again only after 30 days. If it keeps asking anyway, clearing your browser’s cookies for gusto.com and ticking the box again usually fixes it. ### One Healthcare ID (https://www.authenticator.sh/2fa/optum — steps checked on 2026-10-09; One Healthcare ID's own instructions: https://identity.onehealthcareid.com/help/onehealthcareid/en/how-to-setup-passwordless/setup-authenticator) One Healthcare ID — the sign-in formerly called Optum ID, used for the UnitedHealthcare Provider Portal and Optum’s applications — works with any authenticator app that generates six-digit codes, including one in your browser. Select “Set up” next to Authenticator when it is offered at sign-in or under Manage My One Healthcare ID, and scan the QR code from the screen with the Authenticator extension. This is the sign-in for providers, their staff and users of Optum’s applications. Patients and health plan members usually sign in with HealthSafe ID instead, which this guide does not cover. If your screens look different, Optum says another layout of the same options works as well. Set up the authenticator for One Healthcare ID: 1. Open the One Healthcare ID sign-in page on your computer and select “Manage My One Healthcare ID”. 2. Enter your One Healthcare ID or email address and select “Continue”, then your password and “Continue”. If One Healthcare ID sends an access code to your email, enter it and select “Continue”. 3. If a page offers faster and more secure sign-in methods, select “Set up” next to Authenticator. Otherwise select “Manage Authentication”, enter your password, select “Authenticate”, and set up the Authenticator there. 4. When One Healthcare ID shows a QR code, leave that page open and add it to the extension as described below. Then select “Continue”, enter the six-digit code from the extension as the Authenticator Code, and select “Verify & Complete Setup”. Generate your One Healthcare ID recovery code: On the Manage My One Healthcare ID page, go to Account Settings and select “Generate Recovery Code”, confirm with your password and select “Generate code”. Copy or download the 20-character code and keep it away from this computer. It lets you reset the authenticator if you lose it — so does a verified phone number, by text or call. One Healthcare ID warns that without a recovery code or a working method you can be locked out for good and have to create a new account. Q: Do I need Microsoft Authenticator for One Healthcare ID? A: No. Optum’s instructions use Microsoft Authenticator as the example, but the code is a standard time-based one-time password — six digits, new every 30 seconds — and any authenticator produces it. The Authenticator extension generates it in Chrome on your computer and reads the QR code straight off the screen. Q: Is One Healthcare ID the same as Optum ID? A: Yes. Optum ID was renamed One Healthcare ID in 2021; usernames and passwords carried over. Patients and health plan members usually have a different account, HealthSafe ID. Q: What if I lose access to my authenticator? A: On the Authenticator Code screen, select “Reset Authenticator” and verify your identity by text message, phone call or your recovery code. Then set the authenticator up again with the new QR code. Restoring the extension’s automatic backups on a new computer keeps the old codes working without a reset. Q: Can I sign in with the authenticator code instead of my password? A: Optum describes the authenticator as a password-less way to sign in as well as a second step, so you may be offered the code in place of your password. Either way, keep the password and a second method — a phone number or a passkey — on the account. ### NaviNet (https://www.authenticator.sh/2fa/navinet — steps checked on 2026-10-09; NaviNet's own instructions: https://navinet.navimedix.com/help/public/multi_factor_authentication.html) NaviNet multi-factor authentication works with any authenticator app — and NaviNet’s own help covers using a browser extension when a phone is not an option. When the “Set up Multi-Factor Authentication” window appears after you sign in, scan its QR code from the screen with the Authenticator extension, type the code into “Verification Code” and click “Verify”. NaviNet turns MFA on office by office; until it is on for yours, the setup window does not appear. Its QR code is shown during this first setup only, so add it to the extension before you leave the window. You pick one method: an authenticator app on a phone, an authenticator in the browser, or email authentication. For help with your method, NaviNet sends you to your office’s NaviNet security officer — NantHealth Support cannot help with MFA. Set up multi-factor authentication in NaviNet: 1. Open NaviNet in Chrome on your computer and sign in with your username and password. 2. Once MFA is on for your office, NaviNet shows the “Set up Multi-Factor Authentication” window with a QR code that is unique to your account. Do not close it and do not share the QR code. 3. When NaviNet shows the QR code, leave that window open and add it to the extension as described below — or type the long code shown in the window into the extension for manual entry. NaviNet’s help calls the entry NantHealth NaviNet. 4. Type the current code from the extension into the “Verification Code” box, without spaces, and click “Verify”. Plan a way back into NaviNet: NaviNet’s help mentions no backup codes. If you lose your authenticator, your office’s NaviNet security officer is the person to ask — NantHealth Support cannot help with MFA. Because the QR code is shown only once, keep the extension’s automatic backups on: restoring one on a new computer brings the same codes back without anyone resetting your account. Q: Can I use NaviNet MFA without a phone? A: Yes. NaviNet’s help has its own instructions for using an authenticator browser extension “if you can’t use an authenticator app on your phone”: open the extension, scan the QR code in the NaviNet window, and type the code it shows. The Authenticator extension does exactly that in Chrome. Q: Which authenticator app works with NaviNet? A: Any app that generates standard time-based one-time passwords (TOTP) — an authenticator app on your phone or an authenticator extension in your browser. Use the authenticator itself to scan the QR code, not your phone’s camera app. Q: What if I lose access to my authenticator? A: Contact your office’s NaviNet security officer, who manages your NaviNet account — NantHealth Support cannot help with MFA. If the extension’s automatic backups are on, restoring one on the new computer is quicker: the codes carry on working. Q: I have more than one NaviNet username. Which code do I use? A: Each username has its own entry in the authenticator. Use the code from the entry for the username you signed in with — rename the entries in the extension so you can tell them apart. ## Pro and the free plan (https://www.authenticator.sh/pro) Pro removes the limit on how many accounts you can add and keeps an encrypted copy of them in the cloud. Everything else works the same with it or without it. Unlimited accounts: Add as many accounts as you need. Pro turns on by itself in the browser you paid from; on another computer, open the extension, go to “Settings” → “Pro” → “I have a license key”, and enter your license key. Cloud backup: An encrypted copy of your accounts on our server, so losing this computer does not mean losing your codes. Turn it on in “Settings” → “Backup & Restore” → “Cloud backup”. It is locked with a backup recovery code that never leaves your browser, so we cannot open it. On a new computer, enter your license key and then that code. If Pro ends, your copies can still be restored for 90 days. Your codes always keep working: The free limit applies only to adding new accounts. Everything you already have works at any count — your codes, copying them, inserting them with a right-click, export and backups — with Pro, without it, and after it ends. Managing or cancelling: Open the extension and go to “Settings” → “Pro” → “Manage subscription”. That takes you to Stripe's customer portal, where you can change your payment method or cancel. If you cancel, Pro stays on until the end of the period you've already paid for. Payments and refunds: Payments are processed by Stripe through Link, which acts as the merchant of record: it handles checkout, tax, receipts and refunds, and your card details never reach us. For a question about a charge or a refund, write to support@authenticator.sh. ## Releases ### Version 1.15.0: Lose the computer, keep your codes (https://www.authenticator.sh/whats-new/1.15.0) With Pro, the extension keeps an encrypted copy of your accounts on our server. It is locked with a recovery code that never leaves your browser — we cannot open it. How it works: 1. Open “Settings” → “Backup & Restore” → “Cloud backup” and press “Turn on”. You get your backup recovery code; type it once to confirm you saved it, and the first copy is sent. 2. From then on a copy is sent whenever your accounts change and the extension opens, or when you press “Back up now”. Restoring a copy only adds the accounts that are missing. 3. On a new computer, enter your license key, then the recovery code: the newest copy comes in at once. If Pro has ended, “Restore from cloud backup with your license key” still finds your copies for 90 days. Why we cannot read it. A backup of your 2FA secrets on someone else's server deserves a hard look, so here is exactly what reaches ours and what it can do with it. - Encrypted before it leaves your browser: Your accounts are encrypted in the extension with AES-256-GCM, under a key derived from your recovery code. What we store is that ciphertext — no name, issuer, secret or code can be read in it. - The code never reaches us: Our server keeps a short id of the code and a hash of a second value derived from it, which proves a browser holds the code. Neither lets anyone work out the code or the key. If you lose the code, we cannot open your copies either. - Restoring only adds: Like the automatic copies on your computer, a cloud copy only adds the accounts that are missing. Nothing you have is replaced or removed by a restore. - Only the code can delete it: Turning cloud backup off deletes every copy, and it takes the code to do it — the install id the extension uses elsewhere is not enough. With password protection on, the code kept in the extension is encrypted under your password too. Also in this release: - A second style: pick “Modern” in “Settings” → “Appearance”, where light and dark are switched too. “Classic” stays the default, and nothing changes until you choose. - To learn where new users get stuck, a new installation now reports how adding its first account went — which way was picked, which step was reached, which error was shown, as kinds and counts, never what was scanned or typed — within minutes during its first three days. Installations from before this release do not. - The uninstall page now also carries how far a new installation got towards its first account, and the welcome page the install id, which our server keeps only for installations that came from one of our ads. - If Pro ends, your cloud copies stay restorable for 90 days. Buying Pro again from a browser that held the earlier license takes the backup over to the new one. - No new permissions. Still no host permissions and no content scripts. ### Version 1.14.0: If you already use it, nothing changes (https://www.authenticator.sh/whats-new/1.14.0) This release adds a paid plan, Pro. An installation from before this version keeps unlimited accounts, free, exactly as before — there is nothing you need to do. How it works: 1. Installed before this version? Your installation keeps unlimited accounts, free, as before. 2. A new installation may have a limit on how many accounts it holds for free. If it has one and it is full, adding another opens the Pro screen, and every account already there keeps working. 3. When Pro is offered to you, it appears in Settings. Paying happens on Stripe, in a new tab. Pro turns on by itself in the browser you paid from; on another computer, open “Settings” → “Pro” → “I have a license key” and enter the key from your email. What changed, and what cannot. An authenticator that starts talking to a server deserves a hard look, so here is exactly what it sends and what the new limit is able to do. - Your accounts never leave your computer: Once a day the extension checks in with api.authenticator.sh. It sends an anonymous id created by this installation, the version and languages, when it was installed and whether that predates this release, how many accounts it holds — a number, never which ones — whether password protection and sync are on and how it opens, which policy and license it holds and whether it already has its license key, the last four characters of that key, how many times it was opened on each day since the last check-in, and a short list of billing events such as “the paywall was shown”. Never your secrets, account names, issuers, codes or the sites you use them on. - The limit can only stop an addition: Every account you have keeps showing its code, and keeps working with export, backups, restoring and sync — with or without Pro, and if a Pro subscription ends. Nothing is ever hidden or locked. - Checked on your computer: The limit and your license are checked on your computer, from the last data our server signed and the extension verified — so a limit already received still applies offline. Until the extension has reached our server once, nothing is limited. - Paying never touches your codes: Checkout is Stripe's, in a new tab, with Link as the seller of record. From a purchase we receive the email address you paid with, so we can send your license key and send it again if you lose it — never your card details. Also in this release: - There is a monthly and a yearly subscription, and a one-time lifetime purchase. Which ones you see can differ while we find the right prices. If you cancel a subscription, Pro stays on until the end of the period you paid for. - Lost your license key? “Restore a purchase” on the Pro screen sends it to the email you paid with. - When you uninstall, the feedback page now carries the same anonymous id: as it opens it tells our server that installation was removed, and an answer, if you give one, is linked to it. Answering is still optional. - No new permissions. Still no host permissions and no content scripts. - The privacy policy is rewritten to match: what is sent and why, who processes it, how long it is kept, and how to have it deleted. ### Version 1.13.0: A hundred accounts, one paste (https://www.authenticator.sh/whats-new/1.13.0) Paste the list your old authenticator exported and every link in it becomes an account. One action, not one per account — and the same links come back out again whenever you want to leave. How it works: 1. Export from your old app. More of them can than people expect, and several write out a plain list of otpauth:// links. 2. Open Settings → Paste links and paste the whole thing at once. A .txt file of the same links goes through Import instead. 3. Read what it tells you. Added, already here, and — by line number — anything it could not use. Why this is safe. A list of otpauth:// links is the most sensitive text you will ever paste anywhere: every line is a seed that generates codes for that account forever. It is worth being exact about where it goes. - It never leaves your machine: The parsing happens in the popup. There is no upload step and no server to receive one — the extension makes no network request while importing, and the only request it ever makes on its own is an optional check of your clock. - The report counts; it does not quote: When a line cannot be read you get its number and nothing else. Nothing goes to the console either: parsing used to log the name and issuer of every account it read, which was one line per scan before and would have been your entire 2FA inventory on screen after a two-hundred-account paste. It logs nothing now. - The export says what it is: A file of plain links is not encrypted, and you are told so before it is written — including when an account had to be left out of it, which you are asked about rather than informed of afterwards. The password-protected export is still there and still the one for a backup you intend to keep. - Nothing is fetched to draw your list: The optional coloured initials are drawn from the account itself — its own letter, its own stored colour. There are no favicon lookups, because fetching an icon per service would tell whoever answers precisely which sites you hold 2FA for. Also in this release: - Export every account as plain otpauth:// links, one per line, in a text file almost any other authenticator can read. What the export writes is exactly what the import takes back — there is a test holding the two together. - Coloured initials beside your accounts, off by default in Settings — and every account's full name on hover, in every view. - At the smallest window size the compact row gives its width back to the account name, so two accounts on the same service stop looking identical. - Choose where the extension opens: the popup, a floating window, or Chrome's side panel. The window and the panel stay open while you switch tabs and applications — a popup closes the moment it loses focus, which is exactly the wrong behaviour when the code has to stay in front of you while you type it. - When you make a share link you choose the name shown above the code — the account's own by default, or nothing at all when the person opening it has no business knowing which service it is for. - Add account, Edit and Share open as full screens with a back arrow instead of dialogs, and the first-run guide folds its fallback steps away so the button that ends each path stays in view. - Fixes: in Arabic the settings switches drew their knob outside the track, and in languages with a longer name for this app the header pushed its own icons past the edge and cut off the gear. - Settings ends with the version number, so answering “which version are you on?” no longer means leaving the popup to find out. ### Version 1.12.0: Your code, without opening anything (https://www.authenticator.sh/whats-new/1.12.0) Right-click the code field on any site and pick one item. The code goes in. No popup, no switching windows, no reading six digits off a screen and typing them before they expire. How it works: 1. Right-click the field where the code goes. 2. Pick “Insert 2FA code”. The account for the site you are on is chosen for you. 3. The digits land in the field — including the one-box-per-digit kind, which is handled as a paste so the boxes fill in order. Why this is safe. Inserting a code into a page is the one thing this extension does that touches a page at all. It is worth being precise about what that means, because “it can type into websites” and “it can read websites” are very different powers, and only the first one is being asked for. - Nothing runs until you pick it: This is not a content script. No code from the extension exists on any page you visit. It is injected only when you choose the menu item, and what that gesture grants is a single tab, a single invocation, revoked as soon as you navigate. Nothing is left behind afterwards. - It has no permission to read sites: The extension declares no host permissions at all — you can check the list in the Chrome Web Store, it is four short entries and none of them is a website. It cannot read the pages you have open, and it does not know which sites you visit. - It writes; it does not collect: It looks at the input fields on the page for one purpose: to decide which one should receive the code. What it finds is used there and then and goes nowhere else. The extension makes no network request while doing this — there is no server to send anything to. - It refuses rather than guesses: If there is no field it can be confident about, it copies the code to your clipboard and says so, instead of putting it somewhere wrong. If a field is too short to hold the whole code, it declines — a truncated code looks like success and fails at the worst moment. Also in this release: - Unlock a password-protected vault with a passkey — Touch ID, Windows Hello or your phone — while your password and recovery code keep working exactly as before. - Export in Credential Exchange Format, the FIDO Alliance interchange format other password managers and authenticators can read. - The clock check, which had quietly stopped working for everyone, is fixed: three independent time sources instead of two, and corrections now expire. - The interface opens in your browser's language instead of English, in all twenty languages it already shipped in. ## How it works, for security reviewers (https://www.authenticator.sh/how-it-works) ### Architecture The extension is a Manifest V3 Chrome extension that generates TOTP codes locally with OTPAuth. Generating codes, storing accounts and encrypting them involve no backend, and there are no user accounts. We run one server, api.authenticator.sh, for the free plan and Pro — described below — and it never receives a secret, an account name, an issuer or a code. That server holds no key material for anyone's accounts: there is no key escrow and no recovery path controlled by us. If a user forgets their password and loses their recovery code, we cannot help them — by design. ### Cryptography Password protection is optional and off by default. With it on: - Cipher: AES-256-GCM, random 96-bit IV per record and per rewrite - Key derivation: PBKDF2-HMAC-SHA256, 600,000 iterations, 128-bit random salt (OWASP guidance) - Master key: 256-bit, from crypto.getRandomValues, generated once; the password only wraps it - Fingerprints: HMAC-SHA256 under an HKDF-derived subkey, used to merge records across devices - Unlocked key storage: chrome.storage.session — memory only, never written to disk, cleared when the browser closes, unreachable from content scripts - Auto-lock: Every open / 5 / 15 / 60 minutes idle / until the browser closes - Implementation: WebCrypto only. No primitive is hand-rolled and no crypto library is bundled. ### Why two levels of key Data is never encrypted with a password-derived key directly. A random master key encrypts the records; PBKDF2 output only wraps that master key. Two consequences follow, and both matter: - Changing the password rewrites 32 bytes instead of re-encrypting every record, every backup and every export. That bulk rewrite is where storage systems lose data. - A 160-bit recovery code can wrap the same master key independently, so a forgotten password is recoverable. The code is shown once, must be typed back to confirm, and is rotated after each use. Nothing is written to disk until the user has confirmed it. ### What is encrypted, and what is not With password protection on, the entire account record is encrypted except its identifier and fingerprint — including the service name, so a stolen profile does not reveal which services the user holds accounts with. Enabling it encrypts the records, verifies them by decrypting and comparing, and only then removes every cleartext copy: browser local storage, sync, and all seven rolling backup snapshots. With password protection off, accounts are stored unencrypted and, if Chrome Sync is on, replicated through the user's own Google account. We never receive them, but Google holds them. Sync can be switched off, which also removes what is already there. The per-site usage history — which account is used on which domain — is stored locally and is not covered by the vault while it is being collected. Enabling password protection deletes it; it can also be switched off independently. ### Threat model Protects against: - A stolen or copied browser profile directory - Infostealer malware that exfiltrates browser data in bulk - Someone with physical access to an unattended machine - Account records reaching Google through Chrome Sync - A backup file being lost or stolen (password-protected export) Does not protect against: - Malware running as the user while the vault is unlocked - A keylogger capturing the password as it is typed - A compromised browser or operating system - Compromise of the third-party services the codes are for - An unencrypted export you chose to write — plain JSON, otpauth:// links or CXF are readable by anyone who opens the file In short: this protects data at rest. It does not, and cannot, defend a device that is already under an attacker's control while in use. ### Permissions The manifest declares five permissions and no host permissions: - storage: Accounts and settings in local storage, the unlocked key in session storage, and the optional sync copy - activeTab: Reads the active tab's hostname to highlight the matching account, and captures the tab when the user scans a QR code from screen - contextMenus: Adds the “Insert 2FA code” item to the right-click menu, and only on editable fields on http(s) pages - scripting: Injects the one function that puts the code in the field — for a single tab and a single invocation, only after that menu item is chosen - sidePanel: Opens the app in Chrome's side panel when that is the chosen surface; it grants no access to any page There are no content scripts, no tabs, cookies or webRequest permissions, and no web-accessible resources. Nothing of ours exists in a page until you ask for a code there; what runs then is injected for that one tab and that one invocation, under the grant your own click provides, and it leaves nothing behind. ### Camera QR scanning by camera runs on an extension page opened in a tab, not in the popup — a popup is destroyed when it loses focus, which a permission prompt does. This needs no manifest permission: it uses the browser's standard camera prompt, granted per extension origin and revocable in site settings, and it is never requested until the user opens the scanner. Video is decoded locally and never transmitted or stored. ### Free plan, Pro and the daily check-in Since 1.14.0 the extension checks in with api.authenticator.sh once a day — when the browser starts, or after the popup has rendered, never on the way to showing a code. The request is a closed list of fields, built in one function in src/billing/sync.ts and held to that list by a test: - iid: A random id created by this installation. Not linked to a Google account, an email address or the browser — unless the user buys Pro: the purchase record then links the installation bought from, and any installation where the license key is active, to the email address paid with - ver, ui_lang, browser_lang: Extension version, interface language, browser language - installed_at, legacy, legacy_src: When the installation appeared, and whether it predates billing - accounts: How many accounts it holds — a number, never which ones - vault, sync, open_mode, style, dark: Whether password protection and sync are on, and how the extension opens, and which style it uses, light or dark - pid, lid, has_key, key_hint: Which signed policy and license the installation currently holds, whether it already has the license key, and the last four characters of that key - opens: How many times the extension was opened on each day since the last check-in (at most the last 14 days) — a count per day, nothing about what was looked at - events: Queued billing events from a closed list: the limit was reached, the paywall was shown or closed, a plan was chosen, a checkout or a key was tried Never sent: secrets, account names, issuers, codes, or the sites they are used on. The server takes the country from the request at its edge and does not store the IP address. The uninstall page receives the same install id as ?i=: it tells the server the installation was removed, and links an optional survey answer to it. Kept in chrome.storage.local for this: the install id, the last signed policy and license, the license key this installation holds (typed in, or received after buying on it), the daily open counts until the server has them, and the queued events — no account data. While sync is on, whether the installation predates billing and that license key also go into Chrome Sync, so the user's other Chrome profiles pick them up and turn Pro on by themselves; turning sync off removes both from Chrome Sync, and turning it back on puts them back. What comes back, and how the extension treats it: - Tokens: The policy (the free plan's account limit) and the license (Pro) are JWS signed with ES256 (ECDSA P-256) - Verification: WebCrypto, against the public keys compiled into the build (src/billing/keys.ts). A Chrome Web Store build trusts the production key only, and the build check refuses one that carries any other - Offline: The limit and the license are checked locally, from the last signed tokens. Until a signed policy has been received, nothing is limited — an unreachable server can never lock anyone out - What the limit can do: Stop an account from being added, and nothing else. It cannot hide, lock, remove or alter an account, or block codes, export, backups, restoring or sync - Purchases: Stripe Checkout in a new tab, with Link as the merchant of record. The buyer's email reaches us from Stripe, to issue and recover the license key; keys are stored as a hash, plus an encrypted copy so a lost key can be sent again - License key: The check-in's answer carries the key itself only to the installation Pro was bought on, and only until the four characters it reports in key_hint match that key — so a key bought later replaces an older one; an installation where the key was typed in is never sent one The limit is not DRM: the code is open source, and a fork can remove it. What must never be possible is for one person to obtain or use another person's license, or to make someone else's installation limited — that is a vulnerability, and in scope of our security policy. ### Network egress Two kinds of request happen on their own: the clock check and the daily billing check-in. Everything else below happens because the user clicked something. Manifest V3 forbids remote code, and nothing here carries accounts, secret keys or generated codes. In full: - The clock check — Clock-drift check, cached; when none of the sources can be reached, Settings says so. TOTP breaks on a drifted clock. Carries user data? No - authenticator.sh — Welcome page on install; feedback page on uninstall, with the install id in its address; help and support pages when opened from the popup. Carries user data? The install id, on the uninstall page only; otherwise no (ordinary web server logs) - api.authenticator.sh — Billing check-in once a day; checkout, license and portal calls when the user buys Pro, enters a key, restores a purchase or manages a subscription. Carries user data? The fields listed above — never account data. A license key or an email address only when the user types one in - checkout.stripe.com, billing.stripe.com — Stripe Checkout and customer portal, opened in a tab when the user buys Pro or manages a subscription. Carries user data? What the buyer enters there. Stripe's and Link's own terms apply - chromewebstore.google.com — Store listing, opened in a tab on click: the review form from the rating prompt, our password manager from the cross-promo banner. Carries user data? No (Google sees a store page visit like any other) - authenticator.featurebase.app — Public feature board, opened in a tab by the feature-request link in the support footer. Carries user data? Only what the user posts there. Third-party service, its own terms. No fonts, scripts, styles or images load from third-party hosts. Everything needed to render the interface ships inside the package. ### Verifying what we publish You do not have to take any of the above on trust. The extension is open source, and each release is reproducible: 1. Download the published .crx from the Chrome Web Store and unzip it 2. Check out the matching git tag 3. Run npm ci && npm run build on Node 20 LTS 4. Compare the resulting dist/ with the unzipped package A SHA-256 for every file in the produced dist/ is published with each GitHub release as SHA256SUMS-v.txt, in sha256sum format, so step 4 can be a single sha256sum -c run. Differences should be limited to file ordering inside archives and whitespace in minified output across Node patch versions. Runtime dependencies are deliberately few — OTPAuth, React, jsQR, Zustand, Framer Motion and Lucide — pinned by a committed lockfile. A CycloneDX SBOM is available on request. ### What we do not have We are a small independent vendor. If any of the following is a hard requirement for your process, it is better that you know now than three weeks into an evaluation: - No SOC 2, ISO 27001 or comparable certification - No third-party penetration test commissioned to date - No paid bug bounty programme What we offer instead is full source transparency, a verifiable build, a minimal permission surface, and a server that is never sent your secrets, account names or codes in the first place. ## Pages and contacts - Install: https://chromewebstore.google.com/detail/2FA/ebhcbenbgjmaebpgbldimndmfomjmphd - FAQ: https://www.authenticator.sh/faq - Support, the questions people write in about most: https://www.authenticator.sh/support - Support inbox, a person reads it: support@authenticator.sh - Vulnerability reports, never to the support inbox: security@authenticator.sh (https://www.authenticator.sh/security) - Feature requests and votes: https://authenticator.featurebase.app - Code generator, to check a secret key without installing anything: https://www.authenticator.sh/generator - Privacy policy: https://www.authenticator.sh/privacy - Source code: https://github.com/authenticator-sh/2fa