--- title: Two-factor authentication pageTitle: How do I set up two-factor authentication in Notesnook? description: Turn on 2FA for your Notesnook account with an authenticator app, email or SMS, add a fallback method, and save your recovery codes. keywords: - notesnook two factor authentication - notesnook 2fa authenticator app - notesnook 2fa recovery codes - lost 2fa device notesnook schema: howto --- # How do I set up two-factor authentication in Notesnook? Two-factor authentication (2FA) asks for a 6-digit code in addition to your password every time you log in. You set it up from `{{settings}}`, choose one of three methods — an authenticator app, email or SMS — and save the recovery codes Notesnook shows you at the end. ::: info 2FA protects your account, not your notes Your notes are already end-to-end encrypted with a key derived from your password. 2FA stops someone from _logging in_ as you. It is a separate protection from [the encryption of your data.](/how-is-my-data-encrypted) ::: ## The three 2FA methods | Method | What it is | Plan | | --------------------- | ------------------------------------------------------------------------- | ---------------- | | `{{mfaAuthAppTitle}}` | Use an authenticator app to generate 2FA codes. Marked `{{recommended}}`. | All plans | | `{{mfaEmailTitle}}` | Notesnook sends a 2FA code to your account email when prompted. | All plans | | `{{mfaSmsTitle}}` | Notesnook sends an SMS with a 2FA code when prompted. | Pro and Believer | An authenticator app is the recommended option because it generates codes on your device and keeps working without a network connection. ## Turn on two-factor authentication :::tabs key:platform == Desktop/Web 1. Go to `{{settings}}` → `{{authentication}}`. 2. Under `{{twoFactorAuth}}`, press `{{change}}` next to `{{change2faMethod}}`. 3. Confirm the `{{verifyItsYou}}` prompt with your account password. 4. Pick a method on the `{{select2faMethod}}` screen. 5. Follow the method's setup — scan the QR code, or press `{{sendCode}}` for email and SMS — and type the code into `{{enterSixDigitCode}}`. 6. Save the codes on the `{{saveRecoveryCodes}}` screen, then finish. You should now see `{{twoFactorAuthEnabled}}`. == Mobile 1. Go to `{{settings}}` → `{{account}}` → `{{manageAccount}}`. 2. Open `{{twoFactorAuth}}`, then tap `{{change2faMethod}}`. 3. Confirm your identity with your account password. 4. Pick a method from the list. 5. Follow the method's setup — tap `{{copy}}` for the authenticator key, or `{{sendCode}}` for email and SMS — and type the code into the 6-digit field, then tap `{{next}}`. 6. Save the codes on the `{{saveRecoveryCodes}}` screen with `{{copyCodes}}` or `{{saveToFile}}`, then tap `{{next}}`. You should now see `{{twoFactorAuthEnabled}}`. ::: ### Set up an authenticator app :::tabs key:platform == Desktop/Web Notesnook shows a QR code with the instruction `{{mfaScanQrCode}}`. If your app cannot scan it, copy the text key shown underneath instead — spaces do not matter. Your app then displays a rotating 6-digit code to enter. == Mobile Notesnook shows the setup key in a field with a `{{copy}}` button. Tapping it copies the key and opens your installed authenticator app directly. Your app then displays a rotating 6-digit code to enter. ::: ### Set up email Notesnook pre-fills your account email and sends the code there when you press `{{sendCode}}`. You cannot enter a different address — email 2FA always uses your account email. ### Set up SMS SMS 2FA is available on **Pro** and **Believer**. Enter your phone number **with the country code** (for example `+1234567890`), press `{{sendCode}}`, and enter the code from the SMS. On free and Essential plans, selecting `{{mfaSmsTitle}}` shows an upgrade prompt instead — see [Plans & limits](/plans-and-limits). ## Wait 60 seconds between codes For email and SMS, the `{{sendCode}}` button becomes `Resend code in …` and counts down for **60 seconds** after each send. On mobile, requesting a new code too early shows `{{resendCodeWait}}`. The countdown exists both during setup and at login. ## Add a fallback 2FA method A fallback is a second method you can use when your primary one is unavailable — for example email as a fallback when your authenticator app is on a phone you don't have. The method you already use as primary is not offered again in the list. :::tabs key:platform == Desktop/Web 1. Go to `{{settings}}` → `{{authentication}}`. 2. Press `{{addFallback2faMethod}}` (it reads `{{change2faFallbackMethod}}` once one exists). 3. Confirm the `{{verifyItsYou}}` prompt. 4. Pick a method and complete the same setup steps as above. You should now see `{{fallbackMethodEnabled}}`. == Mobile 1. Go to `{{settings}}` → `{{account}}` → `{{manageAccount}}` → `{{twoFactorAuth}}`. 2. Tap `{{addFallback2faMethod}}` (it reads `{{change2faFallbackMethod}}` once one exists). 3. Confirm your identity. 4. Pick a method and complete the same setup steps as above. You should now see `{{fallbackMethodEnabled}}`. ::: ## View or regenerate your recovery codes Recovery codes are single-use codes that log you in when no 2FA method is reachable. Notesnook shows them once during setup, and you can pull them up again at any time. :::tabs key:platform == Desktop/Web 1. Go to `{{settings}}` → `{{authentication}}`. 2. Press `{{viewRecoveryCodes}}` and confirm the `{{verifyItsYou}}` prompt. 3. Use `{{print}}`, `{{copy}}` or `Download` to keep a copy. `Download` saves a `notesnook-recovery-codes.txt` file. 4. Press `{{regenerate}}` to replace the current set with a new one. == Mobile 1. Go to `{{settings}}` → `{{account}}` → `{{manageAccount}}` → `{{twoFactorAuth}}`. 2. Tap `{{viewRecoveryCodes}}` and confirm your identity. 3. Use `{{copyCodes}}` or `{{saveToFile}}` — the file is saved as `notesnook_recoverycodes.txt`. Regenerating codes is available on the desktop and web apps. ::: ::: warning Regenerating invalidates the old codes Once you regenerate, the previous set stops working. Replace any copy you printed or stored. ::: ## What happens when you log in After you enter your email and password, Notesnook asks for a 6-digit code: - With an **authenticator app**, open the app and type the current code. - With **email** or **SMS**, the code is sent automatically as the screen opens. `Resend code in …` is disabled for 60 seconds. - The link at the bottom of the screen — `{{mfaAuthAppSelector}}`, `{{mfaEmailSelector}}` or `{{mfaSmsSelector}}` — opens `{{select2faMethod}}`, where you can switch to your fallback method or choose `{{recoveryCode}}`. Entering a recovery code instead of a 6-digit code logs you in the same way. ## What if I lose my 2FA device? Work through these in order: 1. **Use your fallback method.** On the code screen, follow the `Don't have access to …` link and pick your fallback. 2. **Use a recovery code.** From the same screen choose `{{recoveryCode}}` and enter one of the codes you saved. 3. **Log in on a device that is already signed in** and change your 2FA method from `{{settings}}` — an existing session does not need a fresh 2FA code. ::: danger Notesnook cannot bypass 2FA for you If you have no fallback method, no recovery codes and no logged-in device, support cannot unlock the account — the same way we cannot recover your password or decrypt your notes. Save your recovery codes somewhere outside the phone that holds your authenticator app. ::: ## Turn 2FA off The apps do not expose a switch to disable 2FA once it is enabled. What you can change is the primary method and the fallback method, from the same `{{twoFactorAuth}}` settings. ## Related pages - [Plans & limits](/plans-and-limits) — which plans include SMS-based 2FA - [Your account](/account-settings) — changing your email, password and recovery key - [Recovering your account](/recovering-your-account) — what to do when you forget your password - [How is my data encrypted?](/how-is-my-data-encrypted) — why 2FA and encryption protect different things - [App lock](/app-lock) — locking the app itself on a device you already trust