Turn on two-factor authentication
Add a 6-digit code from an authenticator app to every login, save your 10 recovery codes, and what to do if you lose your phone.
With two-factor authentication (2FA) on, logging in takes your password plus a 6-digit code from an app on your phone. If your password ever leaks, it's useless on its own. Setting it up takes about two minutes.
Any authenticator app that does standard time-based codes (TOTP) works: Aegis, 2FAS, Google Authenticator, Microsoft Authenticator, or the one built into your password manager.
Turn it on
- Log in at my.vpsnine.com and open account.
- In the Two-factor authentication box, choose set up 2FA.
- Scan the QR code with your app. If you can't scan it, type the key shown beside it into the app instead, or, if you're on the phone already, tap open in an authenticator app.
- Enter the code the app shows in 6-digit code and choose turn on 2FA.
Codes change every 30 seconds. If one's rejected, wait for the next, and check your phone sets its clock automatically; a phone that's a minute out will never agree with us.
Save your recovery codes
The moment 2FA is on, you get 10 recovery codes that look like abcd-1234. We show them once. Each code works once without the app. Without them, a lost phone means a slow manual identity check.
Put them in your password manager, or print them and keep them somewhere you'll find. Then choose I saved them: back to account.
The account page shows how many unused codes you have left. To get a fresh ten, turn 2FA off and on again; the old ones stop working.
We also send you an email whenever 2FA is turned on or off, so you'd notice if it wasn't you.
Logging in with 2FA
After your email and password, the panel asks for a Two-factor code. Type the one from your app, or a recovery code, and choose verify.
You get five minutes and five tries per login. After that it says "Too many wrong codes. Log in again" and you start over from the password. Wrong codes are counted per account as well, so after a lot of failures you may have to wait 15 minutes before trying again.
Turning it off
On the account page, choose turn off 2FA. You'll need your password and a current code (a recovery code works too). Your recovery codes are deleted along with it.
If you lose your phone
Log in with a recovery code, then turn 2FA off and on again with the new phone. That also gives you ten new codes.
With no phone and no recovery codes, email [email protected] from the address on your account. We'll need you to prove the account is yours before we change anything, so expect questions and a wait.