# Set up two-factor authentication

Turn on two-factor authentication under **Account → Security**, then save the recovery codes shown after activation.

> **UI-ONLY**
> Enrollment requires you to scan a secret into your authenticator and prove possession. Complete it in your own browser; an agent does not enroll a factor for you.

## Prerequisites

- An active Lepsto account and a signed-in browser, or the enrollment screen shown during sign-in.
- An authenticator app that supports six-digit TOTP codes changing every 30 seconds.
- A place to store recovery codes that you can reach if you lose the authenticator.

SMS and security-key second factors are not supported. Passkey sign-in is a separate method and does not request an additional factor.

## Step 1 — Start enrollment

Open **Account → Security** in the [web app](https://app.lepsto.com/account/security) and start two-factor enrollment. Scan the QR code or enter its text secret in your authenticator.

Enrollment is provisional at this point. Merely scanning the code does not turn the factor on.

## Step 2 — Confirm a code

Enter the six-digit code from your authenticator. A successful confirmation activates the factor.

## Step 3 — Save recovery codes

Copy the ten recovery codes shown after activation. Each works once wherever a TOTP code is accepted. They are shown only once and cannot be recovered from Lepsto later.

## Verify it works

Return to **Account → Security** and confirm that two-factor authentication is on and recovery codes remain. At a later password or social sign-in, complete the code challenge before access is issued.

A challenge expires after five minutes. An incorrect code reports the remaining attempts; exhausting them requires starting sign-in again. A code that has just been used cannot be reused.

## Trusted devices

At the challenge, **remember this device** skips the second factor in that browser for 30 days, if your organization permits it. Other browsers still need their own verification. You can inspect and remove trusted devices individually under **Account → Security**.

Turning two-factor authentication off removes trusted devices. A policy that forbids trusted devices stops honoring existing ones immediately. Ending a normal browser session does not remove device trust.

## Recovery and organization requirements

Regenerating recovery codes replaces the previous ten with a new set shown once. Turning the factor off, regenerating codes, and managing trusted devices require recent confirmation with your password or authenticator code. A Google or GitHub account without a password uses its authenticator code.

An organization can require two-factor authentication and disallow trusted devices. If required, you cannot disable the factor. Someone not yet enrolled is asked to enroll at their next sign-in; an already active session is not interrupted for enrollment.

Across several organizations, the strictest settings apply: enrollment is required if any organization requires it, and remembered devices are permitted only if every organization allows them.