Set up two-factor authentication
Add an authenticator and save recovery codes for your account.
Turn on two-factor authentication under Account → Security, then save the recovery codes shown after activation.
Prerequisites
- An active Lepsto account and a signed-in browser, or the enrollment screen shown during sign-in.
- An authenticator app that supports six-digit TOTP codes changing every 30 seconds.
- A place to store recovery codes that you can reach if you lose the authenticator.
SMS and security-key second factors are not supported. Passkey sign-in is a separate method and does not request an additional factor.
Step 1 — Start enrollment
Open Account → Security in the web app and start two-factor enrollment. Scan the QR code or enter its text secret in your authenticator.
Enrollment is provisional at this point. Merely scanning the code does not turn the factor on.
Step 2 — Confirm a code
Enter the six-digit code from your authenticator. A successful confirmation activates the factor.
Step 3 — Save recovery codes
Copy the ten recovery codes shown after activation. Each works once wherever a TOTP code is accepted. They are shown only once and cannot be recovered from Lepsto later.
Verify it works
Return to Account → Security and confirm that two-factor authentication is on and recovery codes remain. At a later password or social sign-in, complete the code challenge before access is issued.
A challenge expires after five minutes. An incorrect code reports the remaining attempts; exhausting them requires starting sign-in again. A code that has just been used cannot be reused.
Trusted devices
At the challenge, remember this device skips the second factor in that browser for 30 days, if your organization permits it. Other browsers still need their own verification. You can inspect and remove trusted devices individually under Account → Security.
Turning two-factor authentication off removes trusted devices. A policy that forbids trusted devices stops honoring existing ones immediately. Ending a normal browser session does not remove device trust.
Recovery and organization requirements
Regenerating recovery codes replaces the previous ten with a new set shown once. Turning the factor off, regenerating codes, and managing trusted devices require recent confirmation with your password or authenticator code. A Google or GitHub account without a password uses its authenticator code.
An organization can require two-factor authentication and disallow trusted devices. If required, you cannot disable the factor. Someone not yet enrolled is asked to enroll at their next sign-in; an already active session is not interrupted for enrollment.
Across several organizations, the strictest settings apply: enrollment is required if any organization requires it, and remembered devices are permitted only if every organization allows them.