Two-factor authentication

Two-factor authentication (2FA) requires both your password and a one-time code at sign-in. We support TOTP (time-based one-time password) — the standard used by Google Authenticator, 1Password, Authy, and most password managers.

Enabling 2FA on your account

1. Go to Account → Security.
2. Click Enable two-factor authentication.
3. Scan the QR code with your authenticator app, or enter the 32-character secret manually.
4. Enter the 6-digit code your app shows to verify.
5. Save your recovery codes. You'll see 8 ten-character codes — store them in a password manager. You only see them once.

2FA is now active. The next time you sign in, you'll be prompted for a code after entering your password.

Compatible apps

App	Notes
1Password	Recommended. Stores both the password and the TOTP next to each other.
Bitwarden	Free tier supports TOTP.
Google Authenticator	Free, simple, but no cloud sync — bind to one device.
Microsoft Authenticator	Works fine.
Authy	Cloud-synced, multi-device.
Apple Passwords (iOS 18+ / macOS 15+)	Built into the OS.
Yubico Authenticator	For YubiKey hardware tokens.

Anything that supports HMAC-SHA1, 30-second period, 6 digits will work — that's the RFC 6238 standard.

Signing in with 2FA

1. Enter email and password on the sign-in page.
2. The form transitions to a 6-digit code field.
3. Open your authenticator app, find the EmailBuilder entry, enter the current code.
4. Click Verify.

You'll be signed in. Sessions last as long as your normal session would — 2FA doesn't shorten session lifetime.

If you don't have your authenticator app

Three ways to get in:

Recovery code

Click Use a recovery code on the 2FA prompt. Enter one of the 8 codes you saved when enabling. Each recovery code works once — it's marked used and can't be reused.

If you're running low (3 or fewer codes remaining), the Security page warns you. Regenerate from there.

Email code

Click Send code to email on the 2FA prompt. A 6-digit code is emailed to your account address, valid for 10 minutes. You can request one new email code per minute.

This requires:

• Your account email to be reachable (you can read incoming email).
• 2FA was already enabled on your account.

The email code is a backup, not a primary path — it's there for "I left my phone at home" days.

Account recovery

If you've lost your authenticator app, all 8 recovery codes, and your account email, contact [email protected]. We'll verify ownership through other means (last payment, account creation date, recent sends) and disable 2FA on the account so you can sign in and re-enable.

This is slow on purpose. Don't rely on it — keep at least one recovery code somewhere safe.

Disabling 2FA

If you want to turn 2FA off:

1. Go to Account → Security.
2. Click Disable two-factor authentication.
3. Enter your password (skipped if you signed up via Google OAuth).
4. Enter your current TOTP code.

Disabling clears your secret, recovery codes, and any pending email code. You can re-enable later — it'll generate a fresh secret and new recovery codes.

Regenerating recovery codes

You can regenerate the set of 8 recovery codes at any time:

1. Account → Security → Regenerate recovery codes.
2. Enter your current TOTP code to confirm.
3. The previous 8 codes are invalidated; you get 8 new ones to save.

Regenerate when:

• You've used most of the original 8.
• You suspect the codes were exposed (stored in a chat, screenshot, leaked password manager).

Enforcing 2FA for everyone on your account

Admins can require 2FA across the whole team:

1. Account → Security → Account policy.
2. Toggle Require two-factor authentication.

Members without 2FA configured are funneled to setup on their next sign-in — they can't continue until they enable.

This is a per-account setting, not per-user. Toggling it on affects everyone, including the admin who toggled (you should enable yours first or you'll be locked into the setup flow).

Security details

• Secret and recovery codes are encrypted at rest in our database — even if someone copied a database backup, they couldn't reproduce your codes.
• TOTP secrets never leave the server in plaintext after enrollment — even the QR code is generated server-side and discarded after display.
• We accept the previous 30-second window when verifying TOTP to handle clock drift — codes are valid for up to ~1 minute total.
• Recovery codes are consumed one-at-a-time and tracked per-account.

SAML SSO and 2FA

If your team uses SAML SSO, 2FA is handled by your identity provider — not by EmailBuilder. SAML users won't see the 2FA toggle on the Security page. Configure 2FA enforcement in your IdP (Okta, Google Workspace, Azure AD).