Set up two-factor authentication

The short answer

Two-factor authentication asks for a code from an authenticator app on your phone after your password. Turn it on under My Account, on the My profile page, in the Two-Factor Authentication card. Panoramr shows eight recovery codes once. If you lose the phone and the recovery codes, there is no way to reset it yourself.

Who can use it

Any account, on any plan. If the amber bar says Your email address is not confirmed yet, Enable Two-Factor sends you to the Check your inbox page until you confirm it. The code is asked for after your password and after Continue with Google, Continue with Facebook or Continue with Microsoft. Turning it off or asking for new recovery codes needs your password. An account made with one of those providers has no password until you choose one under Update Password, so do that first.

Turn it on

1. Click your name or picture at the top right (on a narrow screen, the menu button), then My Account. On the My profile page find the Two-Factor Authentication card, below Update Password.
2. Click Enable Two-Factor. A QR code and a Setup Key appear.
3. In an authenticator app on your phone, scan the QR code or type the setup key. The QR code names the entry Panoramr and carries your email address.
4. Type the code the app shows into Verification Code and click Confirm Setup.
5. A box headed Your recovery codes lists 8 codes. Copy them somewhere safe, such as a password manager. They are shown only now.

Two-factor is not on until you click Confirm Setup. If you leave first, come back and click Show the QR code again, or click Cancel to drop the setup. Once it is on, the card says Two-Factor Authentication is actively enabled. and Panoramr emails you that it was turned on.

Sign in with a code

1. Log in with your email and password, or with a provider.
2. A page asks you to confirm access with the code from your authenticator application. Type it into Code and click Log in.
3. Without your phone, click Use a recovery code, type one of the 8 codes into Recovery Code and click Log in. Each recovery code works once. Use an authentication code takes you back.

A code from the app is made every 30 seconds and works once. The sign-in also accepts the previous code and the next one, for a phone whose clock is a little off. Five wrong answers in a row, codes and recovery codes together, lock the account's second step for about five minutes and send you back to the password page.

Get new recovery codes

1. On the card click New recovery codes.
2. Type your password and click Get new codes.
3. Eight new codes appear and the old ones stop working. They are shown only now.

Move to a new phone

Panoramr does not show the setup key again once two-factor is on. While you can still sign in, click Disable Two-Factor, then set it up again with Enable Two-Factor and scan the new QR code on the new phone. A new setup makes a new key, so codes from the old phone stop working.

Turn it off

1. On the card click Disable Two-Factor.
2. Type your password and click Turn off. Cancel closes the box.

Signing in then asks for your password only, and Panoramr emails you that two-factor was turned off.

If you lose your phone and your recovery codes

There is no way to reset two-factor yourself. Resetting your password does not turn it off on an account whose address is confirmed (on an account that never confirmed its address, a reset does switch it off), and no page or link in an email removes it.

• Still signed in on a device? Open My profile there. You can get new recovery codes or turn two-factor off with your password.
• Signed out everywhere, with no phone and no recovery code? You cannot sign in, and nothing in the app can sign you in or turn two-factor off for you. The email we send when you turn it on says to write to us if you need help getting back in. You can write to moc.rmaronap@tcatnoc from the address on the account. This page cannot promise more.

Keep your recovery codes where you will find them if you lose the phone.

Troubleshooting

The provided two-factor authentication code was invalid. Type the current code from the app. A code works once, so if you used it a moment ago, wait for the next one. Check that the phone's clock is set automatically. A recovery code goes in Recovery Code, not Code: click Use a recovery code first.

Too many wrong codes. Try again in N minutes. Five wrong codes locked the second step. During setup the message shows under Verification Code. During sign-in you are sent back to the password page. Wait about five minutes, then try again.

The QR code is not on the page. Click Show the QR code again.

I did not save my recovery codes. They are shown once. If you can still sign in, click New recovery codes and save the new ones.

The password box asks for a password I never chose. The account was made with a provider. Choose a password under Update Password first.