Two-step sign-in: a code after your password
With two-step sign-in (also called 2FA) on, signing in on a new device asks for a second step after your password (or after Google or Apple), so someone who learns your password still can’t get in. It is for everyone, on the phone and the website, and off until you turn it on.
Step 1: Open Two-step sign-in
Open App settings.
- Under Account, tap Two-step sign-in.
Step 2: Choose how you get your code
- Email code (the easiest): we email you a 6-digit code when you sign in on a new device. First we send one to check the email reaches you; type it and tap Turn on.
- Authenticator app: a code from an app like Google Authenticator, Microsoft Authenticator or 1Password. Scan the QR code or copy the key into the app, type the 6 digits it shows, and tap Turn on.
With the app, you get 10 backup codes, shown only then: copy them, download them, or write them down. Each one works once, for when your phone isn’t at hand.
Step 3: Once it is on
- New backup codes: 10 new ones (with the app). The old ones stop working.
- Company owners: Require two-step sign-in for admins, under Your company.
Also here: use the other way instead, Forget remembered devices, and Turn off two-step sign-in. Each change first asks you to confirm it is you, with your password, or a code when your account has no password.
Good to know
- Signing in on a new device: type the 6-digit code from the email (it works once, for 10 minutes; Resend code after 30 seconds) or from your app. Remember this device for 30 days is ticked, so that device skips the code; a new password, or Forget remembered devices, ends that. No phone? Use a backup code.
- 10 wrong codes in 15 minutes and the account waits 15 minutes.
- We email you whenever it is turned on or off, or new backup codes are made.
- Require it for admins: only the owner can change it, only once their own is on, and it is off unless they turn it on. Each admin who has it off is told, and asked to turn it on the next time they sign in (or when the app renews their sign-in, every week or two); while it is required, admins can’t turn theirs off. Everyone else chooses for themselves.
- Everyone, with two-step sign-in or not, gets New sign-in to your Ur Timesheet account by email when a device we haven’t seen for them signs in: the device, when, and how. Not for your first device, a remembered device, or when Ur Timesheet support looks at your account. Not you? Use Change your password in the email, write to us, and turn on two-step sign-in. We never show where a sign-in came from: we don’t keep that.
- Lost your phone and your backup codes? Write to support@urtimesheet.com. Ur Timesheet support checks it is you, can turn it off (with a reason that is kept), and you get an email; then turn it on again. Nobody at your company, and not the assistant, can turn it off or see your codes.