Two-factor sign-in

Someone can guess or intercept your password. Two-factor sign-in puts a second hurdle in front of it: a six-digit number that a free app on your phone generates anew every 30 seconds. Without your phone a stolen password is worth nothing.

You decide for yourself whether to switch this on. AdenAI does not require it.

Switching it on, in three steps

In the dashboard, open Profile at the top right, then Two-factor sign-in in the sidebar on the left, then Set up. It takes about two minutes.

1. Install an authenticator app on your phone. They are all free and all work equally well, for example Google Authenticator, Microsoft Authenticator, 2FAS or Aegis. If you already have one for another account, just use that.
2. Scan the code on the screen with the app. The app has a plus sign or an "add account" button for this. AdenAI then appears in the list and shows a six-digit number. If you cannot scan, there is a key below the image that you can type in.
3. Enter the number from the app. This is how we check that the app really arrived. The number changes every 30 seconds. If it is changing right now, wait for the next one.

Straight after that we show you the ten recovery codes.

The recovery codes

• Each code works exactly once and replaces the number from the app while it does.
• You can enter one anywhere AdenAI asks for the six-digit number.
• The Save as file button puts them on your machine as a text file.
• Keep them where you keep other important things: in your password manager, printed in a folder. Not in the same app that generates the codes, and not only on the phone you might lose.
• You can look at them again at any time, under Profile, Two-factor sign-in, View codes. It also says how many you have left.
• Generate new codes replaces all the previous ones. Notes on paper no longer count after that, throw them away.

What changes for you

When signing in, AdenAI asks for your password and then for the number from the app.

The same number also confirms everything that cannot be undone: deleting a project, deleting your account, looking at a project's stored credentials. You no longer need your password for those, and it is no longer accepted there at all. So anyone who only knows your password does not get through.

If you have just confirmed, we do not ask again for the next 15 minutes.

Phone lost, code gone

You still have recovery codes: enter one of them instead of the number when signing in. Then set the app up on your new phone straight away and generate new codes. The code you used is spent.

You have no codes left: then you cannot get back in on your own. Write to support. We have to check that you really are you, and that runs by hand. Expect a few days. That is exactly why the warning is at the top.

Switching it off

Under Profile, Two-factor sign-in, Switch off. Your account then hangs on the password alone again, dangerous actions are confirmed with the password again, and your existing recovery codes stop working.

What we deliberately do not offer

No code by SMS and no security key to plug in. An authenticator app is free, works on every phone and is safer than SMS. With a key to plug in, losing it is final, and for most of our users that is the wrong first step.