Two-step sign-in adds a second step after your password or activation code: you type the 6-digit code shown by an authenticator app on your phone. Someone who knows your password still cannot sign in without your phone. If you lose the phone, one of your recovery codes gets you in instead.
When does the player ask for it?
When two-step sign-in is on for your account, every new sign-in has two steps:
- Your username and password, or your activation code.
- The screen Two-step verification: Enter the 6-digit code from your authenticator app.
It applies in the Android app, on the website and on TVs signed in with a password or an activation code. Devices that are already signed in are not asked again.
The operator can also require it for an account. In that case, the first sign-in leads straight to the setup screen.
How do I set it up?
The setup screen is called Protect your account:
- Open an authenticator app on your phone. Any app that shows 6-digit codes from a QR code works.
- Scan the QR code on the screen. If you can't scan, choose to enter the key shown under it in the authenticator app.
- Type the 6-digit code the authenticator now shows and select Verify.
- The player shows Save your recovery codes. Copy them with Copy codes and keep them somewhere safe, away from your phone. They are not shown again.
- Select Continue. You are signed in.
What are recovery codes?
They are one-time codes that replace the 6-digit code when your phone is lost, broken or reset. On the verification screen, choose Lost your phone? Enter one of your recovery codes instead. and type one. Each code works once, so cross it off after use.
We store recovery codes only as hashes: nobody can read them back, which is why they are shown only once.
Does it work with activation codes?
Yes. If you sign in with an activation code and your account has two-step sign-in, the player asks for the 6-digit code next. The activation code is only used up once that step succeeds, so an interrupted sign-in does not waste it.
How does it work with TV codes?
When you approve a TV from your phone, you are already signed in on the phone, with your two steps done. The TV signs in from that approval and does not ask for the 6-digit code.
What if the code is refused?
- That code is not valid. Try again.: wait for the next code in the authenticator and type it quickly. Codes change every 30 seconds.
- Codes keep failing: the clock on your phone may be wrong. Set the phone's date and time to automatic and try again.
- This step expired. Please sign in again.: the step between password and code lasts a few minutes. Start again from the password.
- Too many wrong attempts lock sign-in for a few minutes, as for passwords.
What if I have no phone and no recovery codes?
Contact the operator through the same channel you received your access from. The operator can reset two-step sign-in on your account; this also signs you out on every device. You then set it up again at your next sign-in.
How is my secret protected?
The authenticator secret is stored encrypted, and recovery codes are stored as hashes. Administrators always use two-step sign-in. The privacy page lists exactly what is stored for sign-in.
Is it worth it?
Yes. It is the most effective protection against a leaked or guessed password, and it costs you a few seconds on each new device only. If your account does not ask for it yet, ask the operator whether it can be turned on for you.