Skip to content

Two-Factor Authentication (2FA)

Add an extra layer of security to your account using time-based one-time passwords (TOTP).

Why Enable 2FA?

Your account protects all your notes, ideas, and personal information. 2FA ensures that even if someone obtains your password, they cannot access your account without a second verification method.

Info

Glassy supports TOTP apps like Google Authenticator, Authy, 1Password, and any compatible authenticator app.

Setting Up 2FA

Step 1: Open Security Settings

  1. Open the Account HUD (click your avatar or storage indicator)
  2. Navigate to Security
  3. Select Enable Two-Factor Authentication

Step 2: Download an Authenticator App

If you don't have one already, install a TOTP authenticator app: - Google Authenticator — iOS, Android - Authy — iOS, Android, Desktop - 1Password — iOS, Android, Desktop, Browser

Step 3: Scan the QR Code

  1. Open your authenticator app
  2. Select Add Account or the + button
  3. Choose Scan QR Code
  4. Point your camera at the QR code displayed on Glassy

Warning

Save your backup codes immediately. They are your only way to recover access if you lose your authenticator device.

Step 4: Verify and Save Backup Codes

After scanning, you'll see a 6-digit code that refreshes every 30 seconds. Enter this code to verify setup.

You'll also receive 10 backup codes. Store these securely: - Print them and keep in a safe place - Save to a password manager - Store in a secure location offline

Each backup code can only be used once.

Step 5: Confirm

Once verified, 2FA is active on your account. You'll need your authenticator code each time you sign in.

Signing In with 2FA

  1. Enter your email and password
  2. When prompted, open your authenticator app
  3. Enter the 6-digit code shown for Glassy
  4. Select Verify

How long a code stays good for

Your authenticator shows a new code every 30 seconds. Glassy accepts the code that is current plus one step either side of it — so in practice a code works for roughly 90 seconds, not 30.

That tolerance is there for you, not for us. By the time you read six digits off your phone, type them, and press Verify, the 30-second boundary has often already rolled over. Without the tolerance the server would reject a code that was perfectly correct when you read it, and there would be nothing you could do differently except wait and try again. This is the behaviour RFC 6238 recommends and what every Google Authenticator-compatible service does, so it is also what your authenticator app already assumes.

On Glassy v2.36.0-beta.42 and later

Earlier builds checked the exact current 30-second step only, so a correct code was rejected whenever the boundary fell between reading it and submitting it — roughly every login that landed in the back half of a step. If you ever had a code refused for no apparent reason and it worked seconds later, that was the bug, not your clock. Upgrade rather than re-syncing your authenticator.

The tolerance is deliberately one step, not two. A code from two steps ago is still rejected: widening further would roughly triple how long a code observed by an attacker stays usable, and would buy no extra protection against the clock skew the tolerance exists to absorb.

A code is a secret for its whole ~90-second life

Because a code stays valid for roughly 90 seconds rather than 30, do not paste a live one into a support ticket, a screenshot, or a chat. Glassy support will never ask you for one.

Using Backup Codes

If you cannot access your authenticator:

  1. On the 2FA verification screen, select Use a backup code
  2. Enter one of your 10 backup codes
  3. After use, that backup code is no longer valid

Danger

Backup codes are single-use. If you've used 7 of your 10 codes, generate new ones from Security Settings.

Managing 2FA

View Backup Codes Remaining

Open Account HUD → Security → Two-Factor Authentication to see how many backup codes remain.

Generate New Backup Codes

If you're running low on backup codes (3 or fewer), generate a new set:

  1. Go to Security Settings
  2. Select Generate New Backup Codes
  3. Confirm—this invalidates your old codes

Warning

Generating new codes invalidates all previous backup codes. Ensure you have access to your authenticator before proceeding.

Disable 2FA

If you need to disable 2FA:

  1. Go to Security Settings
  2. Select Disable Two-Factor Authentication
  3. Confirm with your current authenticator code

Info

We recommend keeping 2FA enabled for maximum account security.

Troubleshooting

QR Code Won't Scan

  • Ensure adequate lighting
  • Clean your camera lens
  • Use Enter Code Manually option and enter the displayed key

"Invalid verification code" for a code you just read

Work through these in order — the first two cover almost every case:

  1. Wait for the next code and try that one. If the current code has only a second or two left on its ring, submit the next one instead. Glassy accepts one step either side of the current step (v2.36.0-beta.42+), so this is a narrow window, but it is the cheapest thing to rule out.
  2. Check your device's clock. TOTP is derived from the time, so a phone whose clock has drifted by more than ~30 seconds will produce codes Glassy cannot match. Set the device to sync time automatically:
  3. iOS — Settings → General → Date & Time → Set Automatically
  4. Android — Settings → System → Date & time → Use network-provided time
  5. Google Authenticator has its own correction tool: Settings → Time correction for codes → Sync now
  6. Check you are reading the right entry. If the same authenticator holds codes for several services, or for a personal and a work Glassy account, it is easy to type the neighbouring one.
  7. On a self-hosted appliance, check the server's clock, not just yours. The tolerance absorbs ~30 seconds of skew in either direction; a container host whose clock is minutes out will reject every code. Compare date -u on the host against a trusted time source, and fix the host's NTP rather than re-enrolling 2FA.
  8. If none of the above, re-enrol. Generate a new secret from Security → Two-Factor Authentication and scan it fresh. Do this last: it invalidates the old secret, so you will need your backup codes if the new enrolment fails part-way.

Re-enrolling issues a brand-new set of backup codes

Disabling 2FA clears both your secret and your existing backup codes, and re-enrolling generates a fresh set of 10 — shown once, in the confirmation step. Your old codes are not carried over and cannot be recovered, so save the new ones before you close that dialog. If you are re-enrolling because a device was lost, this is the moment to make sure the new set is somewhere offline.

Authenticator Shows Wrong Code

  • Check that your device's time is accurate
  • TOTP codes rely on correct time settings
  • Sync your device's clock if needed

Lost Access to Authenticator and Backup Codes

Contact support through the Help Center. You'll need to verify your identity through alternate means.

  • End-to-end encryption for notes and vault data
  • Session timeout and device management in Settings → Security
  • Account recovery via verified email