Two-factor authentication (2FA) adds a second step to signing in: an authenticator app code, in addition to your password. 20dragons uses app-based (TOTP) two-factor authentication — there is no SMS or email code option.

Why use 2FA

Even if someone learns your password, they cannot sign in without also passing the second step.

Enabling 2FA

Go to Account security and start two-factor setup. Setup has three steps:

  1. Step 1 — confirm your current password.
  2. Step 2 — scan the QR code with an authenticator app (or enter the text code shown as a fallback if you cannot scan), then enter the 6-digit code the app shows to confirm it is set up correctly.
  3. Step 3 — you are shown 10 recovery codes. These are shown only once. Save them somewhere safe, then confirm you have stored them to finish setup.

If you do not finish setup, you can restart it.

Important

Save your recovery codes when they are shown. They are not shown again later, and losing both your authenticator and your recovery codes may require contacting support to regain access to your account.

Signing in with 2FA

After entering your password, you will be asked for your 2FA code on a separate step (valid for 10 minutes). Enter the 6-digit code from your authenticator app, or choose to use a recovery code instead.

A wrong code shows "Invalid authentication code." (or "Invalid recovery code." for recovery codes). After 5 failed attempts within 10 minutes, further attempts are blocked temporarily with the message "Too many two-factor attempts. Try again later."

Regenerating recovery codes

You can regenerate your recovery codes from Account security. This requires your password and a valid authenticator code, and it invalidates your previous recovery codes.

Disabling 2FA

You can turn off 2FA from Account security. This requires your password and either an authenticator code or a recovery code.

If you lose access to your authenticator and recovery codes

Contact Support. There is no self-service way to regain access if both your authenticator and all recovery codes are lost.