Two-step verification

Two-step verification adds a second check when you sign in. After you sign in with Google or a magic link, Lexpoint asks for a six-digit code from an authenticator app on your device.

This matters more on Lexpoint than on a site with passwords. Lexpoint has no password — you sign in with your Google account or with a link sent to your email. That means whoever can read your email can sign in as you. Two-step verification breaks that chain: the code lives on your device, not in your inbox.

Lexpoint uses authenticator apps only — never text messages. A code generated on your device cannot be intercepted by someone who takes over your phone number.

Before you start

Install an authenticator app if you do not have one. Any of these work:

• Google Authenticator
• Microsoft Authenticator
• 1Password, Bitwarden, or another password manager with a built-in authenticator
• Authy

Turn it on

1. Go to Settings → Account.
2. Open the Sign-in tab.
3. Under Two-factor authentication, select Enable Two-Factor Authentication.
4. Under Scan QR Code, open your authenticator app and scan the code — point the app’s camera at it. If you cannot scan, select Can’t scan? Enter code manually: a Secret Key appears, with a copy button, for you to type or paste into the app instead.
5. Your app now shows a six-digit code for Lexpoint that changes every 30 seconds. Under Verify Code, enter the current code and select Verify & Enable.

Once confirmed, the section reads 2FA is enabled — Your account is protected with an authenticator app. Cancel setup abandons the setup before that point.

The two-factor authentication panel during setup, showing the QR code to scan.

Save a copy before you finish

If your authenticator app supports backup — a password manager that syncs, or an export — set that up now. If the only copy of your authenticator lives on a phone you might lose, recovery means contacting support and proving who you are.

Signing in from then on

Your next sign-in has one extra step. Sign in as usual — Google, or the magic link sent to your email — and then enter the six-digit code from your authenticator app.

The code is generated on your device and changes every 30 seconds. If it is rejected, the usual cause is a clock that has drifted — check that automatic date and time is enabled on the device running the authenticator.

The sign-in challenge asking for a code from your authenticator app.

Turning it off

Two-step verification can be switched off from the same panel in Settings → Account → Sign-in. Select Disable Two-Factor Authentication. The panel asks Are you sure? and needs a current six-digit code from your authenticator app before Disable 2FA takes effect — so someone who reaches your open session without your device cannot switch it off.

Think carefully first. Because Lexpoint has no password, turning two-step verification off leaves your email inbox as the only thing protecting an account that holds your identity documents and immigration history. Anyone who can read your email can request a magic link and sign in.

If your reason is that the extra step is inconvenient, moving your authenticator into a password manager solves the inconvenience without giving up the protection.

Related

• Sign-in methods — Google and magic-link sign-in
• Identity verification — a different thing: proving who you are, not securing sign-in
• Access and sharing — who else can see your file