Two-factor authentication

Add a second step to sign-in. Ally supports TOTP (time-based one-time password), the standard used by every mainstream authenticator app: Aegis, 1Password, Bitwarden, Authy, Google Authenticator, Microsoft Authenticator, Yubico Authenticator.

Enable it

1. Open your account settings and click Configure 2FA.
2. A QR code appears. Scan it with your authenticator app.
3. Enter the six-digit code the app displays to verify pairing worked.
4. Download the eight recovery codes as a PDF. Print or store somewhere offline — each code works once.
5. 2FA is now on. Every future sign-in adds a code screen after the magic-link click.

Recovery codes

Recovery codes are shown once, when you enable 2FA. Each is single-use; using one automatically regenerates a fresh set the next time you sign in. If you lose them, disable 2FA from account settings while still signed in, then re-enable to regenerate.

Why TOTP and not SMS

SMS 2FA is vulnerable to SIM-swap attacks, especially in the UK where number porting is largely unregulated. TOTP runs on the device without any carrier involvement, and the shared secret never leaves the device after pairing.