# Two-factor authentication and security keys

## What this is about

Your panel account controls your servers, worlds and backups, so it's worth
protecting with more than a password. Two options are available:

- **Two-factor authentication (2FA)**: after your password, you enter a 6-digit code from an app on your phone.
- **Security keys / passkeys**: sign in with your fingerprint, face, phone or a hardware key, with no password needed.

You can use either one, or both.

## Setting up two-factor authentication

You'll need an authenticator app on your phone, such as Google Authenticator,
Microsoft Authenticator, Authy or 2FAS.

1. Click your name (bottom-left) to open **Account**.
2. In the **Two-Factor Authentication** card, click **Setup Two-Factor**.
3. Scan the **QR code** with your app (or type in the code shown under it).
4. Enter the **6-digit code** from your app and your **password**, then click **Enable**.

[![Setting up two-factor authentication (QR code hidden)](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/scaled-1680-/acct-2fa-setup.png)](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/acct-2fa-setup.png)

### Save your recovery codes!

You'll now be shown **10 recovery codes**. **Copy them and keep them
somewhere safe**: a password manager, or printed out. Each code works once and
lets you in if you lose your phone.

<p class="callout danger"><strong>You will only see these codes once.</strong> If you lose your phone <em>and</em> your recovery codes, you'll need to contact support to get back in.</p>

### Signing in with 2FA

After your password, enter the 6-digit code from your app and click **Verify
Code**. Lost your phone? Click **Use Recovery Code** and enter one of your
saved codes.

<p class="callout info"><strong>"Invalid code"?</strong> Codes depend on your phone's clock. Make sure its time is set automatically. The panel also warns you if your computer's clock is off.</p>

### Turning 2FA off (or moving to a new phone)

Click **Disable Two-Factor**, enter a code from your app (or a recovery code)
and your password, then click **Disable**. To move to a new phone, disable it
and set it up again on the new one.

## Security keys and passkeys

A **passkey** lets you sign in with your device's fingerprint reader, face
unlock, PIN, or a hardware key like a YubiKey. You don't type a password, and
it can't be phished.

### Adding one

1. Go to **Account → Security Keys** and click **Create**.
2. Give it a **Name** (e.g. "My laptop") and enter your password.
3. Leave **Allow signing in without a username** on, so you can sign in with one click.
4. Click **Create** and follow your browser or phone's prompt.

[![Adding a security key](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/scaled-1680-/acct-seckey-create.png)](https://knowledgebase.suhosting.net/uploads/images/gallery/2026-10/acct-seckey-create.png)

<p class="callout info">Using an older hardware key and setup fails? Turn <strong>Allow signing in without a username</strong> off and try again. Some keys have limited storage.</p>

### Signing in with a passkey

On the login page, click **Sign in with a Passkey** and follow the prompt. Or
type your username and choose **Use Passkey**.

### Turning off password login (optional)

Once you have a passkey, you can stop your password working entirely: in the
**Password Login** card on the Account page, click **Disable**.

<p class="callout warning">This also stops your password working for <strong>SFTP</strong>, so you'd need an <a href="https://knowledgebase.suhosting.net/books/account/page/sessions-api-keys-and-ssh-keys">SSH key</a> for that. Make sure your passkey works before turning this off.</p>

## Lost access?

- **Lost your 2FA phone:** sign in with a recovery code, then set up 2FA again.
- **No phone and no recovery codes:** open a support ticket from your [billing account](https://suhosting.net/dashboard). We'll verify it's you before removing 2FA.