Skip to content

Two-factor authentication

In addition to your password, you sign in with a 6-digit code from an authenticator app on your phone. Your account stays protected even if your password leaks.

Everyone≈ 3 minutesAuthenticator app on your phone

Google Authenticator, Microsoft Authenticator, FreeOTP or any other TOTP app works.

Turning it on

  1. Click Two-Factor Authentication in the Zimlets panel at the bottom left; the Two-Factor window opens.
  2. The top line of the window shows the state of your account: Two-factor authentication is OFF.
  3. Press Enable authenticator.

The two-factor window: status (2) and Enable authenticator (3)

The two-factor window: status (2) and Enable authenticator (3)
  1. The window shows a secret key (Secret), an otpauth URI (Authenticator import) and a list of Scratch codes (save these). Add the secret key to the authenticator app on your phone; if the app can import links, use the otpauth URI. The Copy button next to each copies the value.
  2. Copy the scratch codes with Copy scratch codes and keep them somewhere safe.
  3. Type the 6-digit code shown in the app into Code and press Confirm code.

The status line now reads Two-factor authentication is ON. From your next sign-in, a code is asked after your password.

If your administrator made it mandatory

If two-factor authentication is required and you have not set it up yet, the setup screen opens by itself after you enter your password. Add the key shown to your authenticator app and enter the 6-digit code it generates; webmail opens when setup is done.

If you lose your phone

  • At sign-in, type one of your scratch codes instead of the app code. Each scratch code works once.
  • After signing in, use Generate new scratch codes in the Scratch / recovery codes section of the Two-Factor window; the old codes stop working.
  • If you have no scratch codes either, ask your administrator to reset your two-factor authentication, then set it up again.

Trusted devices

If you chose to trust a device at sign-in, no code is asked on that browser for a while. Remove a single device with Revoke or all of them with Revoke all trusted devices in the window's Trusted devices list. Do this right away if you lose your computer.

Turning it off

Press Disable in the Two-Factor window. You cannot turn it off if your administrator made it mandatory.

Desktop and phone mail apps

Clients such as Outlook or your phone's built-in mail app cannot ask for a code at sign-in. For these clients, use the method your administrator gives you (an application-specific password).