Account & Security

Protect your DS160.io account with two-factor authentication (2FA), save your recovery codes, and manage MFA settings.

Two-factor authentication (2FA) adds a second step to sign-in: after your password, you enter a short code from an authenticator app on your phone. Even if someone learns your password, they can’t get in without that code. This guide shows how to turn it on, save your recovery codes, and turn it off.

Signed in with Google? Your account is already protected by Google’s own two-step verification, so the steps below don’t apply.

Open the Security page

From inside your workspace, click Security in the sidebar. This is where you enable, manage, and disable two-factor authentication.

Enable two-factor authentication

Enrollment is a short wizard:

  1. Scan the QR code. Open your authenticator app (Google Authenticator, Authy, 1Password, etc.) and scan the QR code shown on screen. Can’t scan? Enter the setup key shown beneath the code manually instead.
  2. Verify a code. Your app now shows a 6-digit code that rotates every 30 seconds. Type the current code to confirm the link worked.
  3. Save your recovery codes. We show a one-time list of single-use recovery codes. Copy or download them and store them somewhere safe — they are the only way back into your account if you ever lose your phone.

Once you confirm, 2FA is active. The next time you sign in, you’ll be asked for a code after your password.

Recovery codes

Recovery codes are your backup. Each code works once. If you can’t reach your authenticator app, choose the recovery-code option at sign-in and enter one of them.

Keep them somewhere separate from your phone — a password manager or a printed copy in a safe place. If you run low or think they’ve been exposed, disable and re-enable 2FA to generate a fresh set.

Disable two-factor authentication

On the Security page, choose Disable. For your protection, this requires your current password and a valid 2FA code (or a recovery code). Once disabled, sign-in goes back to password-only and your old recovery codes stop working.

Next steps