Two-factor sign-in

Two-factor sign-in adds a second check after your password (or Google, Microsoft, or Apple): a code from an authenticator app, or a passkey. It’s off until you turn it on in Settings.

Turn on two-factor sign-in

1. Open the account menu (your avatar at the top of the app) and choose Settings.
2. Choose the Account tab, then turn on the Two-factor sign-in switch.
3. Stichos asks “How do you want to confirm it’s you?” Choose one, type your password under it, then choose Continue:
   • Authenticator app: a 6-digit code from Google Authenticator, 1Password, Authy, and the like.
   • Passkey: Touch ID, Face ID, Windows Hello, or a security key. If you sign in only with Google, Apple, or Microsoft and have no password, Stichos doesn’t ask for one. If it says to sign out and sign in again first, do that, then turn two-factor on within 10 minutes.
4. Connect it:
   • Authenticator app: scan the QR code with your app. Can’t scan? Type the setup key shown under it. Then type the code the app shows and choose Confirm.
   • Passkey: give it a name if you like, choose Create passkey, and approve it in your browser’s window.
5. Save your ten recovery codes: choose Download, Print, or Copy. You won’t see them again.
6. Tick I’ve saved these codes, then choose Turn on two-factor.

Two-factor is on only after that last step: Settings then shows On, and every other device you were signed in on is signed out. A passkey here is a second check after your password, never a replacement for it. Two-factor applies to every way of signing in.

Choose an authenticator app or a passkey as your second step.

Example

Elena tutors a Russian class, so she turns on two-factor with her phone’s authenticator app. She also adds her laptop’s Touch ID as a passkey, so losing her phone never locks her out.

Sign in with two-factor on

1. Sign in as usual, with your password or your provider.
2. If you have a passkey, your browser asks for it straight away. Approve it, and you’re in.
3. Otherwise, or if you close that window, Stichos asks “Enter your code”. Type the 6-digit code from your app and choose Sign in. With no authenticator app, it asks for a recovery code instead.

Under the code you can choose Use a passkey instead or Use a recovery code. Can’t use any of these? tells you how to reach us.

Trust this browser, or forget trusted browsers

On the code step, Trust this browser for 30 days is ticked. A trusted browser skips the code, but never your password, for 30 days from that sign-in. Untick it on a shared or school computer.

In Settings, Trusted browsers shows how many browsers skip the code. Forget all makes each one ask again. Changing or resetting your password, changing your email, and Sign out everywhere forget them too.

Add a second method, or replace one

With two-factor on, Settings › Account lists your ways to confirm it’s you:

• Add an authenticator app or Add a passkey.
• Replace moves your authenticator app to a new phone.
• Rename changes a passkey’s name.
• Remove takes a method away. Stichos first asks “Remove the authenticator app?” or “Remove passkey …?” (naming the passkey); choose Remove to confirm, or Cancel to keep it. Your last method has no Remove: turn two-factor off instead.

Use or replace your recovery codes

Each of the ten recovery codes works once: use one when your phone is lost or your app isn’t at hand. Settings shows how many are left, such as “8 of 10 left”.

To get a fresh set, choose Make a new set in Settings, then Make a new set again to confirm. Save the new codes, then choose Done. Your old codes stop working at once.

Why Stichos asks for a code again

If you haven’t used a code or passkey in the last 10 minutes, a Confirm it’s you box asks for one (or a recovery code) before: turning two-factor off, removing a method, adding or replacing a method, making new recovery codes, forgetting trusted browsers, changing your password or email, removing a linked Google, Microsoft, or Apple sign-in, downloading your data, and deleting your account. Where a change also asks for your password, you give both.

Turn off two-factor sign-in

1. In Settings › Account, turn off the Two-factor sign-in switch.
2. Stichos asks: “Turn off two-factor? Your authenticator app, passkeys, recovery codes, and trusted browsers will be removed.” Choose Turn off.

If you’ve lost every way to sign in

If you have no app, no passkey, and no recovery codes, write to info@stichos.com from your account’s email address. We’ll help you get back in.

Why can’t I reset it myself?

There’s no automatic reset, on purpose: someone who gets into your email can’t switch the second check off. When we turn two-factor off for you, your account is signed out everywhere and we email you.

“Too many wrong codes”

After several wrong answers in a short time, Stichos stops accepting codes for your account for a while, whichever method you use. The message says how long to wait.

The QR code changed while I was setting up the app

If you started setup twice, say in two tabs, only the newest setup can be confirmed. When you confirm an older one, Stichos says “That setup was replaced by a newer one” and shows a new QR code. Scan it, type the code it shows, and delete the earlier Stichos entry from your app.

It says “This browser can’t make passkeys”

Your browser can’t make passkeys, so Stichos says “This browser can’t make passkeys.” Use an authenticator app, or add a passkey later from another browser.

Related: Sign-in methods · Settings and account · Troubleshooting · Contact us