Setting up two-factor authentication

What Is Two-Factor Authentication?

Two-factor authentication (also called MFA or 2FA) adds an extra layer of security to your account. With MFA enabled, logging in requires two things:

1. **Something you know** — Your password
2. **Something you have** — A code from your authenticator app

Even if someone steals your password, they can't access your account without the second factor.

How to Enable MFA

Step 1: Go to Security Settings

1. Click **Settings** in the left sidebar
2. Select **Security**
3. Find the **Two-Factor Authentication** section

Step 2: Scan the QR Code

Click Enable MFA. FileJoy will display a QR code on screen. Open your authenticator app (we recommend Google Authenticator, Authy, or 1Password) and scan the QR code.

If you can't scan the QR code, click Enter manually to see a text code you can type into your authenticator app.

Step 3: Enter the Verification Code

Your authenticator app will generate a 6-digit code. Enter it in FileJoy to verify that everything is set up correctly.

Step 4: Save Your Backup Codes

After verification, FileJoy generates 10 backup codes. These are one-time-use codes you can use to log in if you lose access to your authenticator app.

This is critical: Copy or download these codes and store them somewhere safe (password manager, printed in a secure location, etc.). Each code can only be used once.

Logging In with MFA

Once MFA is enabled, your login process adds one step:

1. Enter your email and password as usual
2. Open your authenticator app
3. Enter the current 6-digit code
4. You're in!

Using Backup Codes

If you can't access your authenticator app:

1. On the MFA code screen, click **Use a backup code**
2. Enter one of your saved backup codes
3. You'll be logged in normally

Remember: each backup code works only once. If you're running low, disable and re-enable MFA to generate new codes.

Disabling MFA

If you need to turn off two-factor authentication:

1. Go to **Settings > Security**
2. Click **Disable MFA**
3. Enter your password to confirm
4. MFA is now off

We strongly recommend keeping MFA enabled at all times, especially during tax season when your account contains sensitive information.

Tips

• Use a dedicated authenticator app, not SMS-based codes (authenticator apps are more secure)
• Store backup codes in a password manager or a physical safe
• If you get a new phone, set up MFA on the new device before wiping the old one
• Consider enabling MFA on your email account too—it's often the recovery method for other accounts