Two-factor authentication

With two-factor authentication turned on, signing in needs two things: your password and a 6-digit code from an authenticator app on your phone. A stolen or guessed password alone is then not enough to get into your account. It is optional, and each person turns it on for their own account.

Any authenticator app that supports time-based codes works, for example Google Authenticator, Microsoft Authenticator, 1Password or Authy.

Turning it on

Two-factor authentication is set up in the web app:

Open the menu with your name at the bottom of the sidebar and choose Security.
Click Turn on and confirm your password.
Scan the QR code with your authenticator app. If you can't scan it (for example because the app is on the same device), enter the key shown under the QR code instead.
Enter the 6-digit code the app shows and click Verify and turn on.
Save the backup codes that appear. They are shown only once.

When you turn it on, all your other sessions are signed out, so every browser and phone has to sign in again with a code. You also get an email confirming the change; if you ever receive that email without having made the change yourself, reset your password right away.

Signing in

After your email and password, Tunori asks for the current code from your authenticator app. This works the same in the web app and in the mobile app.

Trust this device for 30 days (web only) skips the code on that browser for the next 30 days. Only use it on a device that is yours. Each sign-in within that time extends it.
After several wrong codes you have to start the sign-in again, and after ten wrong codes in a row the account is locked for 15 minutes.

Backup codes

Backup codes are for when you don't have your phone. You get ten of them, and each one works once: on the code step, choose Use a backup code instead and enter one. Keep them somewhere safe and separate from your phone, such as a password manager or a printed copy.

Running low, or not sure where they are? Under Security, choose New backup codes. This replaces the whole set, and the old codes stop working.

Turning it off

Under Security, click Turn off and confirm your password. Devices you trusted are forgotten, and you get an email confirming the change.

Lost your phone?

Sign in with one of your backup codes.
Under Security, turn two-factor authentication off and then on again to connect your new phone. This also gives you a fresh set of backup codes.