Two-step verification

Two-step verification adds a second check when you sign in. After you sign in with Google or a magic link, Lexpoint asks for a six-digit code from an authenticator app on your device.

This matters more on Lexpoint than on a site with passwords. Lexpoint has no password — you sign in with your Google account or with a link sent to your email. That means whoever can read your email can sign in as you. Two-step verification breaks that chain: the code lives on your device, not in your inbox.

Lexpoint uses authenticator apps only — never text messages. A code generated on your device cannot be intercepted by someone who takes over your phone number.

Before you start

Install an authenticator app if you do not have one. Any of these work:

• Google Authenticator
• Microsoft Authenticator
• 1Password, Bitwarden, or another password manager with a built-in authenticator
• Authy

Turn it on

1. Go to Settings → Account.
2. Open the Sign-in & security tab.
3. Find Two-factor authentication and start the setup.
4. A QR code appears. Open your authenticator app and scan it — point the app’s camera at the code.
5. Your app now shows a six-digit code for Lexpoint that changes every 30 seconds. Enter the current code to confirm the pairing.

Once confirmed, the section reads Your account is protected with an authenticator app.

The two-factor authentication panel during setup, showing the QR code to scan.

Save a copy before you finish

If your authenticator app supports backup — a password manager that syncs, or an export — set that up now. If the only copy of your authenticator lives on a phone you might lose, recovery means contacting support and proving who you are.

Signing in from then on

Your next sign-in has one extra step. Sign in as usual — Google, or the magic link sent to your email — and then enter the six-digit code from your authenticator app.

The code is generated on your device and changes every 30 seconds. If it is rejected, the usual cause is a clock that has drifted — check that automatic date and time is enabled on the device running the authenticator.

The sign-in challenge asking for a code from your authenticator app.

Turning it off

Two-step verification can be switched off from the same panel in Settings → Account → Sign-in & security. You will be asked to confirm.

Think carefully first. Because Lexpoint has no password, turning two-step verification off leaves your email inbox as the only thing protecting an account that holds your identity documents and immigration history. Anyone who can read your email can request a magic link and sign in.

If your reason is that the extra step is inconvenient, moving your authenticator into a password manager solves the inconvenience without giving up the protection.

Related

• Sign-in methods — Google and magic-link sign-in
• Identity verification — a different thing: proving who you are, not securing sign-in
• Access and sharing — who else can see your file