Skip to main content
Two-factor authentication (2FA) adds a one-time code to every sign-in. Even if someone has your password, they cannot get in without the code from your phone. Budget Bandit uses TOTP codes from a standard authenticator app.

​
Enroll

You need an authenticator app such as Google Authenticator, 1Password, Authy, or Bitwarden.
1

Open Settings, then Security

Find the two-factor authentication section and start the setup.
2

Scan the QR code

Open your authenticator app and scan the QR code shown. If you cannot scan, copy the setup key shown beneath it and enter it manually.
3

Enter the 6-digit code

Type the current 6-digit code from your app and verify it. This confirms your app and the app are in sync.
4

Save your recovery codes

You are shown 8 recovery codes. Copy or download them, then confirm you have saved them somewhere safe. From now on, sign-in asks for a code from your app.

​
Recovery codes

Recovery codes are your way back in if you lose your phone or your authenticator app.
  • You get 8 codes when you enroll.
  • Each code works once.
  • Store them in your password manager or print them and keep them somewhere safe.
To replace them, open Settings, then Security, and choose Regenerate. The old codes stop working the moment new ones are generated. Regenerate if you are running low or think a code was exposed.
If you lose both your authenticator app and your recovery codes, you can be locked out. Save your recovery codes before you finish enrollment.

​
Step-up on sensitive actions

Some actions ask you to re-enter a code even though you are already signed in. This is called step-up, and it protects the highest-risk operations:
  • Starting, changing, or cancelling your subscription
  • Opening the billing portal
  • Deleting your account
  • Managing two-factor settings
When you see the step-up prompt, enter a current code from your authenticator app and the action continues.

​
Turn off two-factor

Open Settings, then Security, and choose Disable two-factor. Your authenticator and recovery codes are both invalidated. You may be asked for a code to confirm.

​
If you are locked out

If you cannot sign in and your recovery codes are gone, see Contact support.

Change your password

Set a new password from Settings.

Sync and privacy

How your data is protected.