Turning on two-step sign-in
A code from your phone, or from your email, as well as your password. Two minutes to set up, recovery codes for the day you lose the phone, and why we ask every family to do it.
Updated 28 September 20262 min read
The short version. Settings, Security, Set up an authenticator app, scan, type the code, save the eight recovery codes. From then on, signing in takes your password and a six-digit code from the app. No app? Use email codes instead.
Why
Your household's calendar holds where your children are and when. A password alone can be guessed, reused from a site that leaked, or typed into a fake page. A second step means someone with your password still cannot get in. It is the single most useful thing you can do for the account, and it takes two minutes.
Setting up with an app
- Settings, Security, Set up an authenticator app.
- Open your authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy, or the one built into iPhone's Passwords) and scan the square. Or type the key shown beside it.
- The app shows six digits. Type them and press Turn on.
- Eight recovery codes appear, once. Copy them somewhere safe. Each one signs you in once if you ever lose the phone.
Setting up with email codes
Press Set up email codes. Bobbie emails you a six-digit code; type it in and press Turn on. From then on a code arrives by email each time you sign in. It lasts five minutes.
Signing in afterwards
Password first, as before. Then a page asks for the code from your app or your email. If you have lost the phone, press Lost your phone? Use a recovery code.
Where you are signed in
The same page lists every device with your account open. If one is not yours, type your password and press Sign the others out, then change your password. Changing your password signs the other devices out on its own.
What is really happening
The authenticator app and Bobbie share a secret made when you scanned; both compute the same six digits every thirty seconds, and a code cannot be replayed. Email codes are made fresh each time and expire in five minutes. Recovery codes are stored hashed, like passwords. Five wrong codes in a minute lock the step for a minute. People who run Bobbie itself are required to use it.
Questions people ask
- I don't have an authenticator app. Is email enough?
- It is much better than a password alone. Press Set up email codes instead: Bobbie emails you a six-digit code, you type it in, and from then on a code comes to your email each time you sign in. The app is stronger because email itself can be broken into; use the app if you can.
- Do I need a code every single time?
- Each time you sign in, yes. If you tick Remember me you stay signed in on that device for a long time, so in practice it is rare.
- I lost my phone and my recovery codes.
- Email [email protected] from the address on your account. We will check it is you and turn two-step off so you can set it up again. Please give us a day.