Overview

Two-factor authentication (2FA) adds a second step to signing in. After you enter your password or click a magic link, Truestamp asks for a short code from an authenticator app on your phone. Even if someone learns your password, they cannot finish signing in without that second factor. Turning 2FA on is optional and is done from your profile.

Truestamp uses the standard time-based one-time password (TOTP) method, which works with any common authenticator app (for example Google Authenticator, 1Password, or Authy). The app shows a fresh six-digit code that changes every thirty seconds. When you enroll, you scan a QR code once; from then on your app can produce a valid code offline, with no network connection to Truestamp.

Because a phone can be lost, enabling 2FA also gives you a set of single-use recovery codes. Each recovery code works exactly once and lets you sign in when you cannot reach your authenticator app. You can regenerate a fresh set at any time, which replaces the old set.

Two-factor authentication is a second step for password and magic-link sign-ins only. If you sign in with a passkey, that sign-in is already strong on its own and the 2FA step does not apply.

Turning on two-factor authentication

You enable 2FA from the security section of your profile. Choosing “Enable 2FA” opens a setup page that immediately shows a QR code:

1. Open your authenticator app and scan the QR code (or enter the shown key manually).
2. Your app starts generating six-digit codes for your Truestamp account.
3. Enter the current code back on the setup page to confirm you scanned it correctly.

The confirmation step matters: Truestamp does not consider 2FA active until you prove your app is producing valid codes. Only after a correct confirmation code is 2FA switched on for your account.

Once 2FA is enabled, your profile shows it as “Enabled” and offers a link to view and save your recovery codes.

Signing in with two-factor authentication

With 2FA enabled, a password or magic-link sign-in has two steps. First you authenticate as usual (password or magic link). Then Truestamp sends you to a verification page and asks for the current six-digit code from your authenticator app. Your session is not usable until this second step succeeds: you cannot skip the code prompt and navigate to the rest of the app.

If you cannot produce a code (for example your phone is unavailable), the verification page offers a “use a recovery code” path instead, where you enter one of your saved recovery codes.

Passkey sign-ins do not show this step. A passkey already proves possession of your device, so there is no separate second factor to enter.

Recovery codes

Recovery codes are your backup way in when your authenticator app is unavailable. They exist only while 2FA is enabled, because they back up the same second step.

Key properties:

• Single use. Each recovery code works exactly once. Using a code consumes it, so it cannot be reused.
• A saved set. Enabling 2FA gives you a batch of codes to save somewhere safe (a password manager is a good choice). The display page offers a “Copy all codes” button so you can store them in one step.
• Regeneration replaces the set. From “Manage recovery codes” you can generate a fresh batch. Generating new codes replaces any previous codes, so the old ones stop working immediately. This is the right move if you think your saved codes were exposed, or if you have used up most of them.
• Stored safely. Truestamp stores only a hashed form of each code, not the code itself. Truestamp shows you the plaintext codes once, at the moment you generate them; if you lose them, you regenerate a new set rather than recovering the old ones.

Because generating a new set invalidates the previous set, the app asks you to confirm before regenerating, and never regenerates automatically just because you opened the page.

Turning off two-factor authentication

You can disable 2FA from your profile with “Disable 2FA”. Disabling removes the authenticator secret so no further codes are required, and it also clears your recovery codes, since those only back up the second step you just turned off. If you want 2FA again later, you enroll again from scratch and receive a new QR code and new recovery codes.

Protection against guessing

TOTP codes are short, so Truestamp rate-limits how often codes can be entered. Both the sign-in verification step and the enrollment confirmation step allow only a few attempts within a short window before further attempts are refused. The limit is scoped to your own account, so one account hitting the limit never blocks anyone else from signing in. This makes brute-force guessing of the six-digit code impractical while leaving normal use unaffected.

Recovery-code attempts are recorded in your account’s security activity, so repeated failures are auditable.

Guarantees and limitations

What 2FA gives you:

• A second, independent factor for password and magic-link sign-ins, so a leaked password alone is not enough to access your account.
• Offline codes: your authenticator app generates valid codes without contacting Truestamp.
• Single-use recovery codes as a backup, with the ability to rotate them at any time.

What it does not do:

• It does not protect passkey sign-ins, which are already a strong single-step credential and intentionally skip the 2FA prompt.
• It is not account recovery on its own: if you lose both your authenticator app and your recovery codes, the codes cannot be recovered, only regenerated while you still have access, so save your recovery codes when you enable 2FA.
• The recovery codes shown at generation time are displayed once; Truestamp keeps only a hashed form and cannot show them to you again.