Protecting your account

Your account opens your appointments, your family members and your contact details. You can add a second verification to it: after your password, sign-in then asks for a 6-digit verification code shown by an app installed on your phone. All of it is set from your profile, in the "Two-factor authentication" section.

What two-factor authentication adds

Without it, your email and your password are enough to open your account. With it, someone holding your password gets no further: they would also need the phone that produces the code.

The code changes every 30 seconds and works only once. Your app computes it on its own, with no text message and no network: it keeps working even when your phone has no connection at all.

Choosing an authenticator app

Any common authenticator app will do, and the most widely used ones are free:

• Google Authenticator
• Microsoft Authenticator
• Aegis Authenticator, on Android

Install it before you start. The setup screen waits for a first code, and that code can only come from this app.

Turning two-factor authentication on

1. Open your profile

   From your space, go to "Profile", then scroll down to the "Two-factor authentication" section. The register shown in the page margin takes you straight there.

2. Flip the switch

   Turn "Two-factor authentication" on. The panel opens on the line "What you need · A free app such as Google Authenticator or Microsoft Authenticator.", then a guide numbered 1 to 3: open the app and choose Add an account, scan this QR code, enter the 6-digit code shown. The QR code appears under that guide, with a key you can copy, and an amber warning reminds you: "Keep your backup codes safe. If you lose your phone and your codes, contact the Noresia team to regain access."

3. Scan the QR code

   In your app, choose to add an account, then point the camera at the QR code on screen. The new entry carries the name Noresia and your phone number. If the camera cannot read the image, press "Copy" and paste the key into your app as a manual entry.

4. Enter the first code

   Your app shows a 6-digit code. Type it into the "Code" field.

5. Confirm the setup

   The "Turn on" button only arms once the switch has moved. Press it: the message "Two-factor authentication turned on." confirms the setting was saved.

6. Keep your backup codes

   The panel then shows "Your backup codes": 10 single-use codes, displayed once only. Each one stands in for your phone once if you lose it. The "Download the codes" and "Copy the codes" buttons take them with you: print them or keep them somewhere safe, outside your inbox, then press "I have saved my codes".

What changes when you sign in

At your next sign-in, your email and your password open a second step titled "Two-factor authentication". Type the verification code shown by your app into the "Verification code" field, then press "Verify". The same step appears after you open a verification link received by email.

Under the code field, "Don't have your phone? Use a backup code" opens the backup-code entry: each code works only once, and "Back to the 6-digit code" returns to the normal step.

Three details are worth knowing:

• This step stays open for 5 minutes. Past that, start the sign-in again from the beginning.
• You have 5 attempts. Beyond that the step closes and your password is asked for again.
• A code already used does not pass a second time. If the code is not accepted, wait for the next one rather than entering the same code again.

The whole sign-in path is described in signing in, and the emailed link in verifying your email address.

If you lose access to your app

Your backup codes are the first recourse: at sign-in, "Use a backup code" accepts any of your remaining codes, once each. A lost phone no longer locks you out while a code remains.

Two precautions keep that door open:

• Keep the codes you downloaded at setup somewhere safe, away from the phone itself and outside your inbox.
• If your app offers a backup or a transfer to a new phone, set it up before changing devices.

If the phone and the codes are lost together, resetting your password will not be enough: the second step is still asked for after the reset, and no setting in your space lets you bypass it. Write to the Noresia team from the Contact page of the site, giving the email address of your account. After an identity check, they remove the lost factor: you then sign in with your password alone, and you can turn two-factor authentication back on whenever you wish, with a fresh key and fresh codes.

Turning two-factor authentication off

Removing it asks for a code as well. That is what stops a session left open on a shared device from removing the protection on your behalf.

1. Go back to the Two-factor authentication section

   You will find it at the bottom of your profile, under "Security".

2. Return the switch to rest

   A "Turn-off code" field appears under the switch.

3. Enter a current code

   Open your app and copy across the code showing at that moment.

4. Confirm the removal

   Press "Turn off two-factor authentication". The message "Two-factor authentication turned off." confirms the protection was removed.

The other habits that protect your account

• A password of at least 12 characters, kept for noresia alone. The change happens in changing your password, and the route when you forget it in forgotten password.
• "Sign out the other devices", in the "Security" section, closes every session open elsewhere. The detail is in managing your sessions.
• A verified email address, since it is the one that receives the recovery links. It is updated in updating your profile.

These three settings live on the same screen as two-factor authentication, in your profile.