Two-step sign-in and your password

Your security page is at core.enios.one/account/security (sign in with your usual username and password).

The authenticator

With the authenticator on, every sign-in asks for a six-digit code from an app on your phone as well as your password. Someone who learns your password still cannot get in.

1. Install an authenticator app if you have none: Google Authenticator, Microsoft Authenticator, 1Password, Aegis and Bitwarden all work.
2. On the security page, press Set up, scan the square code with the app (or type the key by hand), and enter the first code the app shows.
3. Write down the ten recovery codes that appear. They are shown once. Each one works a single time instead of a code from the app, for the day you lose your phone.

A code is good for 30 seconds and can be used once. If a right-looking code is refused, the phone's clock is off: set it to automatic time.

Mail programs and phones are not asked for a code. They sign in with the password only, over IMAP and SMTP, as before. The authenticator protects the web interfaces and the account itself.

Recovery codes

The security page shows how many are left. New recovery codes replaces the whole set; enter a current code from the app to get them. Keep them where you keep other important papers, not in the mail account they protect.

Turning it off

Enter a current code (or a recovery code) and press Turn off. Sign-in then needs the password alone. An administrator can turn it off for someone who has lost both the phone and the codes, after checking who they are.

Changing your password

Enter the current password and the new one twice. The new password must have at least 12 characters and must not contain your username. The change signs out every other session, and mail apps on your phone and computer need the new password too. A notice goes to your address and to your alternative address.

If you have forgotten the password, use Forgotten password instead.