Two-factor authentication — what we offer and why

Two-factor authentication adds a second step to sign-in so that even if your password leaks, an attacker can't get in without your physical device.

Turtini supports three second factors:
1. Authenticator app (TOTP) — a 6-digit code from Google Authenticator, 1Password, Authy, or any RFC 6238-compatible app. Works on every device.
2. Passkeys (WebAuthn) — biometric one-tap sign-in using your device's secure enclave (Face ID, Touch ID, Windows Hello, Yubikey). Stronger than TOTP and faster.
3. Recovery codes — a one-time set of 10 codes you save somewhere safe (password manager, locked drawer). Used when your phone / passkey is lost.

Recommended setup:
• Enroll a passkey on every device you sign in from regularly (laptop, phone, tablet) — they're tied to the device.
• Enroll TOTP as a portable backup for occasional sign-ins from new devices.
• Generate recovery codes once, store them somewhere safe, and forget them — they're for the day you lose everything else.

Where it lives:
Settings → Two-factor authentication. The section shows your current state, lets you enroll, regenerate recovery codes, see trusted devices, and remove factors.

Turning it off, or regenerating recovery codes, asks for your password:
Both weaken the protection on your account, so both need more than an open browser tab. Turning off the second factor removes the control that is designed to survive a stolen password; regenerating recovery codes invalidates every code you already saved. If someone else were using your session, either would let them lock you out quietly. Typing your password proves it is you.

The same section has "Sign out everywhere" if you ever need to evict a session you did not start. See "Someone else may be in my account".

If you signed in with Google:
The "second factor" is your Google account's own 2FA, not a separately-enrolled Turtini one. We honor whatever Google enforces. You can still register a passkey on your Turtini account for one-tap re-entry on the device.

When we ask for the second factor:
On every new device. Once you mark a device as "trust this device for 30 days" we won't ask again on that device for the duration. After 30 days, or if a security event triggers a re-challenge, we'll prompt again.