Two-Factor Authentication

What is two-factor authentication?

Two-factor authentication (2FA) adds a second step to your sign-in process. After entering your password, you also enter a six-digit code from an authenticator app on your phone. Even if your password is stolen, an attacker cannot sign in without that code.

FloopFloop uses TOTP (time-based one-time passwords), the same standard used by Google Authenticator, 1Password, Authy, and most password managers.

Setting up 2FA

1. Go to your Account page.
2. Find the Two-Factor Authentication section and click Enable.
3. Scan the QR code with your authenticator app, or copy the secret key and add it manually.
4. Enter the six-digit code your app shows to confirm setup. If the code is correct, 2FA is now active on your account.
5. FloopFloop will display a list of backup codes. Save them somewhere safe — they let you sign in if you lose your phone.

Signing in with 2FA enabled

After entering your email and password, you are taken to a verification page. Enter the current code from your authenticator app to complete sign-in. The code rotates every 30 seconds.

Backup codes

Backup codes are one-time-use codes you can use instead of your authenticator app. Use one whenever you do not have your phone available. Each backup code can only be used once, so generate new ones if you run low.

• Store backup codes in a password manager or printed in a safe place.
• Never share them with anyone — they grant full account access.
• Generate new codes from the 2FA section if you suspect they may be exposed.

Disabling 2FA

You can disable 2FA at any time from the same Two-Factor Authentication section. You will need to enter your current password and a fresh authenticator code to confirm. We strongly recommend keeping 2FA enabled.

Lost your authenticator app?

If you lose access to your phone and have backup codes, use a backup code to sign in and immediately set up 2FA on a new device. If you have neither your authenticator app nor any backup codes, contact support — account recovery requires identity verification and can take several days.