# Turn on two-step verification

> Protect your account with a 6-digit code from an authenticator app. Set it up, sign in with it, keep your recovery codes safe, and turn it off if needed.

Source: https://priortasks.com/docs/account/two-factor-authentication/
Last updated: 2026-11-05

Two-step verification asks for a second proof when you sign in: a 6-digit code from an authenticator app on your phone. A stolen password alone then cannot open your account. It is optional, free on every plan, and works with any authenticator that supports the standard time-based codes, such as 1Password, Google Authenticator, Authy or Microsoft Authenticator.

## Turn it on

1. Open **Settings → Security**. Under **Two-step verification**, choose **Turn on**.
2. Scan the QR code with your authenticator app. If you cannot scan, choose **Copy the key** and type it into the app.
3. Type the 6-digit code the app shows under **Enter the 6-digit code the app shows**, then choose **Turn on**.
4. Save your recovery codes. Choose **Download** or **Copy**, keep them somewhere safe, then choose **I saved them**.

You get 10 recovery codes. Each signs you in once if you lose your phone. They are shown only this one time. The row then reads "On · {count} recovery codes left".

> [!warning]
> Store the recovery codes outside your phone, in a password manager or on paper. Without your phone and without them, you cannot sign in, and you would have to write to support.

If the page says "Not available on this server yet", two-step verification is not turned on for the server you use.

## Sign in with it

After your password (or after **Continue with Google**), Prior asks for the code.

- Type the 6-digit code from your app under **Authentication code**, then choose **Verify**.
- Lost your phone? Choose **Use a recovery code instead**, type one code (it looks like `xxxxx-xxxxx`) and choose **Verify**. Each code works once.
- The sign-in has 5 minutes and 5 attempts. If it runs out, the screen says "This sign-in expired. Sign in again."
- After 10 wrong codes in a row, verification locks for 15 minutes: "Too many wrong codes. Try again in 15 minutes."
- A code works once. If you used it a moment ago, wait for the next one, which comes every 30 seconds.

It applies on every sign-in method, including Google. AI assistants you connect to Prior do not ask for the code each time: once you allowed them, they use their own access, which you can revoke. See [Devices and sessions](https://priortasks.com/docs/account/devices-and-sessions/).

## Get new recovery codes

In **Settings → Security**, choose **New recovery codes**, enter a current code from your app, and choose **Create**. The old codes stop working at once.

## Turn it off

In **Settings → Security**, choose **Turn off**. Prior asks for a current code from your app or a recovery code, and for your password. If you only use Google, you must have signed in within the last 10 minutes: otherwise sign out, sign in again, then retry. Sign-in then only asks for your password or Google account.

## Good to know

- Your phone's clock must be right for the codes to match. Turn on automatic date and time on the phone.
- Deleting your account also asks for a code when two-step verification is on.
- Changing your password through **Forgot password?** signs you out everywhere, and the code still applies at the next sign-in.