Two-factor authentication

Two-factor authentication applies to your team’s side of Docsroom. The people you ask never have a password to protect; they use private links, and nothing on this page changes for them.

Turning it on

1. Open your initials at the foot of the left-hand rail, or choose Settings.
2. Under Two-factor authentication, choose Turn on. A QR code appears, with the setup key underneath for typing in by hand.
3. Scan it with an authenticator app on your phone. Any app that produces six-digit codes works: Google Authenticator, Microsoft Authenticator, 1Password, Apple Passwords, Authy.
4. Type the six-digit code the app shows to confirm. From now on, sign-in asks for your password and then for the current code.

The code changes every 30 seconds, and one either side of the current one is accepted so a phone whose clock has drifted still works. A code that has already been used is refused, so a screenshot of one is no use to anyone who has it.

Recovery codes

When you turn two-factor on, Docsroom shows eight recovery codes. Each one signs you in once instead of an app code. Save them somewhere that is not your phone: a password manager, or printed and kept with your other records. They are shown once. To get a fresh set, choose New recovery codes on the Settings page and confirm with your password; the old set stops working the moment the new one is issued.

Losing a phone

• Sign in with your password, then choose Use a recovery code and enter one of them.
• On Settings, choose Turn off and then Turn on again to pair your new phone. Your old recovery codes stop working and a new set is shown.
• If you have no recovery codes either, an admin can open the dots menu beside your name on the Team page and choose Remove two-factor, after confirming who you are. That signs you out everywhere, lets your password alone sign you in again, and is recorded in the activity trail under the admin’s name. Turn two-factor back on as soon as you are in.

Seeing who has it on

There is no switch that forces two-factor on for everyone, and no column that lists who has it. The one place it shows is the dots menu beside a person on the Team page: Remove two-factor only appears for someone who has set it up. Ask, and check.

Sessions

Two-factor is checked when a session starts. A session ends when the browser closes, and in any case after twelve hours, unless you chose Keep me signed in on this device, in which case it lasts 30 days and extends while you use the app. Resetting your password, changing it in Settings, or an admin removing you from the team, ends your other sessions at once.

Read next