ContextQMD
Back to Notesnook

Two-factor authentication

docs/help/contents/two-factor-authentication.md

3.4.10-android7.9 KB
Original Source

How do I set up two-factor authentication in Notesnook?

Two-factor authentication (2FA) asks for a 6-digit code in addition to your password every time you log in. You set it up from {{settings}}, choose one of three methods — an authenticator app, email or SMS — and save the recovery codes Notesnook shows you at the end.

::: info 2FA protects your account, not your notes Your notes are already end-to-end encrypted with a key derived from your password. 2FA stops someone from logging in as you. It is a separate protection from the encryption of your data.

:::

The three 2FA methods

MethodWhat it isPlan
{{mfaAuthAppTitle}}Use an authenticator app to generate 2FA codes. Marked {{recommended}}.All plans
{{mfaEmailTitle}}Notesnook sends a 2FA code to your account email when prompted.All plans
{{mfaSmsTitle}}Notesnook sends an SMS with a 2FA code when prompted.Pro and Believer

An authenticator app is the recommended option because it generates codes on your device and keeps working without a network connection.

Turn on two-factor authentication

  1. Go to {{settings}} → {{authentication}}.
  2. Under {{twoFactorAuth}}, press {{change}} next to {{change2faMethod}}.
  3. Confirm the {{verifyItsYou}} prompt with your account password.
  4. Pick a method on the {{select2faMethod}} screen.
  5. Follow the method's setup — scan the QR code, or press {{sendCode}} for email and SMS — and type the code into {{enterSixDigitCode}}.
  6. Save the codes on the {{saveRecoveryCodes}} screen, then finish.

You should now see {{twoFactorAuthEnabled}}.

Set up an authenticator app

Notesnook shows a QR code with the instruction {{mfaScanQrCode}}. If your app cannot scan it, copy the text key shown underneath instead — spaces do not matter. Your app then displays a rotating 6-digit code to enter.

Set up email

Notesnook pre-fills your account email and sends the code there when you press {{sendCode}}. You cannot enter a different address — email 2FA always uses your account email.

Set up SMS <PlanTag plan="pro" />

SMS 2FA is available on Pro and Believer. Enter your phone number with the country code (for example +1234567890), press {{sendCode}}, and enter the code from the SMS. On free and Essential plans, selecting {{mfaSmsTitle}} shows an upgrade prompt instead — see Plans & limits.

Wait 60 seconds between codes

For email and SMS, the {{sendCode}} button becomes Resend code in … and counts down for 60 seconds after each send. On mobile, requesting a new code too early shows {{resendCodeWait}}. The countdown exists both during setup and at login.

Add a fallback 2FA method

A fallback is a second method you can use when your primary one is unavailable — for example email as a fallback when your authenticator app is on a phone you don't have. The method you already use as primary is not offered again in the list.

  1. Go to {{settings}} → {{authentication}}.
  2. Press {{addFallback2faMethod}} (it reads {{change2faFallbackMethod}} once one exists).
  3. Confirm the {{verifyItsYou}} prompt.
  4. Pick a method and complete the same setup steps as above.

You should now see {{fallbackMethodEnabled}}.

View or regenerate your recovery codes

Recovery codes are single-use codes that log you in when no 2FA method is reachable. Notesnook shows them once during setup, and you can pull them up again at any time.

  1. Go to {{settings}} → {{authentication}}.
  2. Press {{viewRecoveryCodes}} and confirm the {{verifyItsYou}} prompt.
  3. Use {{print}}, {{copy}} or Download to keep a copy. Download saves a notesnook-recovery-codes.txt file.
  4. Press {{regenerate}} to replace the current set with a new one.

::: warning Regenerating invalidates the old codes Once you regenerate, the previous set stops working. Replace any copy you printed or stored.

:::

<!-- TODO: screenshot — the Save recovery codes screen with the Print / Copy / Download / Regenerate buttons -->

What happens when you log in

After you enter your email and password, Notesnook asks for a 6-digit code:

  • With an authenticator app, open the app and type the current code.
  • With email or SMS, the code is sent automatically as the screen opens. Resend code in … is disabled for 60 seconds.
  • The link at the bottom of the screen — {{mfaAuthAppSelector}}, {{mfaEmailSelector}} or {{mfaSmsSelector}} — opens {{select2faMethod}}, where you can switch to your fallback method or choose {{recoveryCode}}.

Entering a recovery code instead of a 6-digit code logs you in the same way.

What if I lose my 2FA device?

Work through these in order:

  1. Use your fallback method. On the code screen, follow the Don't have access to … link and pick your fallback.
  2. Use a recovery code. From the same screen choose {{recoveryCode}} and enter one of the codes you saved.
  3. Log in on a device that is already signed in and change your 2FA method from {{settings}} — an existing session does not need a fresh 2FA code.

::: danger Notesnook cannot bypass 2FA for you If you have no fallback method, no recovery codes and no logged-in device, support cannot unlock the account — the same way we cannot recover your password or decrypt your notes. Save your recovery codes somewhere outside the phone that holds your authenticator app.

:::

Turn 2FA off

The apps do not expose a switch to disable 2FA once it is enabled. What you can change is the primary method and the fallback method, from the same {{twoFactorAuth}} settings.