Two-factor authentication

Two-factor authentication protects the first gate of the two-gate model — proving who you are. You sign in with your master password; turning on two-factor authentication means a second proof is required as well — a rotating 6-digit code from your authenticator app, or a passkey — so a leaked password on its own gets nobody in.

Set up two-factor authentication#

1. Open Account → Two-Factor Auth and choose Enable 2FA.
2. Confirm your password. The setup key is only shown after the server has checked your account password, so a signed-in session on its own cannot add an authenticator.
3. Scan the QR code with any TOTP authenticator app (Google Authenticator, Aegis, 1Password, …). Can't scan? Enter the setup key manually instead.
4. Verify by entering the 6-digit code your app shows.
5. Save your backup codes. They're displayed once. Choose Download .txt or Print, or copy them with Copy all and tick I have saved these codes somewhere safe once they're stored, then choose Done. Done won't close the sheet until you've downloaded, printed or ticked the box — copying alone doesn't count, because your clipboard is cleared after a short delay.

Once enabled, the Authenticator app card shows an Enabled badge and a Turn off button, with your backup codes underneath.

Turn two-factor authentication off#

On Account → Two-Factor Auth, choose Turn off and confirm with your master password and a current code from your authenticator app (or one of your backup codes). Both are checked on the server, not just in the dialog — a session and a password on their own are not enough to strip a login factor.

Turning it off destroys every remaining backup code and clears the authenticator secret. To use 2FA again afterwards you enroll from scratch and receive a fresh set of codes.

You can't turn 2FA off — and the control is not shown — when:

• your account is an administrator account, where it is mandatory; or
• your organization requires two-factor authentication. The card says Required by your organization, and the requirement holds for as long as you are a member. See Password & authentication policies.

When you'll be asked for a code#

• Signing in from a device that isn't trusted — trusted devices skip the challenge; see Devices.
• Sensitive actions — for example, disabling Travel mode requires a code.

Backup codes#

Backup codes are issued when you enable 2FA and live in the same card, under Backup codes. They only exist while 2FA is on: turning 2FA off destroys whatever is left.

• Each code works once. The card shows how many are left — for example 7 of 10 codes remaining — and warns you once you're down to three or fewer.
• Generate new codes at any time by confirming your master password. Every existing code stops working immediately, used or not, and the new set is shown once with the same Copy all / Download .txt / Print options as at setup.
• Generate a new set when you are running low, or straight away if you think someone else has seen your codes — it is the only way to make a leaked code stop working.
• Store them offline with your Emergency Kit, not inside PulsVault — a backup code locked in the vault it unlocks is not a backup.

Passkeys#

A passkey can stand in for the authenticator code. After your password, your browser asks you to confirm with your fingerprint, face, screen lock or security key instead of you typing a code. You can have an authenticator app, passkeys, or both, and each account can hold up to ten passkeys.

• At signup. Your account creation offers to add your first passkey straight away, without asking for your password again; see Create your account.
• Adding one. Under Passkeys on this page, Manage passkeys opens the list and Add passkey starts the steps: your master password, then your browser creates the passkey, then you name it (it starts as "Passkey"). The first passkey on an account turns two-factor sign-in on. If you press Cancel in the browser prompt you are simply back at the list.
• Signing in offers Use passkey first when your account has one. Your authenticator code and your backup codes stay available as links beneath it. Platform staff sign in the same way on the admin console.
• Account recovery also accepts a passkey as the second factor.
• Backup codes. If a passkey is your only second factor, adding it gives you a set of backup codes, shown once. They work at sign-in and at account recovery, exactly as described above. If you add an authenticator app later, you keep the same set. They never work for confirming a sensitive action such as deleting your account.
• Sensitive actions. Where this page says "enter the code from your authenticator app" — deleting your account, turning Travel Mode off, recovering your Access Key — a passkey works too.
• Removing one asks for your master password, and the confirmation says what it costs. If it is your last second factor, removing it turns two-factor sign-in off and destroys your backup codes (the button reads Remove passkey and turn off 2FA). If your organization requires two-factor sign-in, you cannot remove your last second factor: the passkey shows a note and has no Remove button until you add another passkey or an authenticator app.
• Turning two-factor off is refused while a passkey exists. Remove your passkeys first.

Reading the list#

Each passkey shows when it was added and when it was last used (Never used until its first sign-in), with Rename and Remove beside it. The badges say what it does:

Badge	Meaning
Sign-in	You can use it after your password to sign in. Every passkey has this.
Unlocks vault	You turned on vault unlock for it: one touch can open your vault (see below).
Unlock setup pending	Its vault-unlock setup has not run yet. Choose Finish setup with your vault unlocked.
Sign-in only	Your browser or device did not give it the secret vault unlock needs, so it can sign you in but not open your vault.
Unlock off	You turned vault unlock off for it. Turn on unlock brings it back.
Synced	Your passkey provider currently backs it up, so it follows you to your other devices.
This device only	It is not synced now. Some can sync later; hover for which.

A passkey the server stopped trusting because its counter went backwards, which is what a copied key looks like, is marked Held: remove it, then add it again if it is really yours.

Unlocking your vault with a passkey#

On a passkey that supports it (most platform passkeys and recent security keys), you can use the same touch to open your vault. Adding a passkey ends with Touch your passkey again, or choose Finish setup or Turn on unlock on its row — your vault has to be unlocked, because the setup protects your vault key with a secret only that passkey can produce. Your master password is asked for again if the passkey is more than ten minutes old.

• At sign-in, one touch after your password signs you in and opens your vault. If your browser or the passkey cannot do that, you are signed in with the vault locked and unlock it the usual way.
• When the vault is locked, the unlock window opens on Passkey: choose Unlock with passkey and confirm in your browser. If the passkey cannot unlock here, switch to Phone or Access Key in the same window.
• Turn off unlock (with your master password) removes only that ability; the passkey still signs you in. Removing the passkey removes its unlock too, and recovering your account removes every passkey.
• Changing your master password or rotating your Access Key keeps it working.

A passkey that syncs (marked Synced) means your passkey provider holds a key that can open your vault, as a trusted phone does. Your password is still required to sign in. Your vault key and the passkey's secret never leave your browser: PulsVault stores only an encrypted copy that this one passkey can open.

What changes a passkey#

Changing your master password or rotating your Access Key leaves your passkeys alone. Recovering your account removes every passkey on it, because recovery means the account may have been compromised. You can add them again once you are back in, and the confirmation email says so.

Other methods#

Hardware security keys work as passkeys. Your password itself is managed with your Emergency Kit; see Recovery & Emergency Kit.

Related#

• Recovery & Emergency Kit — the instruments that get you back in
• Devices — devices that skip the 2FA challenge
• Active sessions — see where you're signed in
• Two-gate model — how sign-in and vault unlock differ