A password can leak: reused on another site, guessed, or typed into a fake page. Two-factor authentication adds a second step. After your password, JM Tech Power asks for a short code from an app on your phone, so someone who only has your password still cannot get in.

It matters a little more here than on most sites, because other people can sign in to their own apps through your JM Tech Power account.

What you need

An authenticator app on your phone, such as Google Authenticator, 1Password or Aegis. Any app that supports standard time-based codes will work. It shows a new 6-digit code every 30 seconds.

Turn it on

1. Sign in, open the Workspace menu at the top and choose Two-factor auth, or go straight to https://jmtechpower.com/settings/2fa.
2. Press Set up two-factor authentication.
3. In your authenticator app, scan the QR code. If you cannot scan it, open Can’t scan it? Enter the key by hand and type the key instead.
4. Type the 6-digit code the app shows and press Confirm and turn on.

Two-factor is not switched on until you confirm a code, so a mistake while setting it up cannot lock you out.

Save your backup codes

Right after you turn it on, you get 10 backup codes. They are shown only once: we keep just a scrambled (hashed) copy, so we cannot show them again. Write them down or save them in a password manager, somewhere other than your phone.

Signing in from now on

1. Enter your username and password as usual.
2. On the next screen, type the current 6-digit code from your app and press Verify.

If a code is refused, check that the time on your phone is set automatically. The codes depend on the clock, and a phone that is a few minutes out will produce the wrong ones.

Lost your phone?

Type one of your backup codes in the code box instead. Each backup code works once. After you use one, the site tells you how many are left, and the Two-factor auth page shows the count too. When you are back in, set the app up again on your new phone.

Turning it off

On the same page, enter a current code (or a backup code) and press Turn off. A code is required on purpose: someone who found your computer signed in cannot quietly remove the protection.

Ready? Open Two-factor auth. For more on keeping the site safe, see our security articles.