Security: 2FA and passkeys
Protect your account with an authenticator app, backup codes and passkeys (fingerprint, Face ID, Windows Hello, security keys).
Overview
Two features protect your Trakily account beyond your password. Both live in Account → Security and work for email and password accounts and for accounts that sign in with Google.
| What it does | |
|---|---|
| Two-factor authentication | After your password (or Google), Trakily asks for a 6-digit code from an authenticator app. Backup codes cover a lost phone. |
| Passkeys | Sign in with your fingerprint, face, screen lock, a security key or a password manager. No password, no code, and nothing a phishing page can steal. |
- Two-factor authentication
- What it does
- After your password (or Google), Trakily asks for a 6-digit code from an authenticator app. Backup codes cover a lost phone.
- Passkeys
- What it does
- Sign in with your fingerprint, face, screen lock, a security key or a password manager. No password, no code, and nothing a phishing page can steal.
Turn on two-factor authentication
- 1
Open Account → Security and choose Set up authenticator app. Confirm your password (Google accounts skip this if you signed in within the last day).
- 2
Scan the QR code with an authenticator app such as 1Password, Google Authenticator, Microsoft Authenticator, Authy or Bitwarden. On a phone, tap Open in authenticator app, or type the setup key by hand.
- 3
Enter the 6-digit code the app shows. Two-factor authentication is on as soon as the code is accepted.
- 4
Save your 10 backup codes: copy them into your password manager or download them as a text file. They're shown only once.
From then on, every password or Google sign-in asks for a code. Tick Trust this device for 30 days to skip it on your own computer. Signing in with a passkey never asks for a code, since a passkey is already two factors in one.
Backup codes
- Each code signs you in once, instead of the 6-digit code. Choose Use a backup code on the code screen.
- Account → Security shows how many you have left. New backup codes creates a fresh set of 10 and every older code stops working.
- Creating new codes or turning two-factor authentication off needs your password or a current code.
Passkeys
A passkey is a key pair your device or password manager creates for trakily.com. The private half never leaves it, and it only works on the real site, so it can't be phished or reused.
- Add one: Account → Security → Add a passkey, optionally with a name like "MacBook Touch ID". Your browser asks which to use: this device (Touch ID, Face ID, Windows Hello, Android screen lock), a phone nearby, a security key, or a password manager such as iCloud Keychain, Google Password Manager, 1Password or Bitwarden. Adding one needs a sign-in from the last 24 hours.
- Sign in: choose Sign in with a passkey on the login page, or pick your passkey from the email field's suggestions where the browser offers them.
- Manage: the list shows each passkey's name, whether it syncs across devices, when it was added and when it last signed in. Rename or remove any of them; a removed passkey stops working right away.
Add more than one (for example your laptop and your phone) so losing a device never locks you out.
How your account is protected
- We email you whenever two-factor authentication is turned on or off, backup codes are replaced, or a passkey is added or removed.
- A sign-in waiting for its code expires after 10 minutes or 5 wrong codes. After 10 wrong codes in a row, code sign-in pauses for 15 minutes. Code and passkey attempts are also rate-limited per network.
- Resetting your password doesn't skip the code: you're asked for it right after the reset, and trusted devices have to enter a code again.
- The authenticator secret and backup codes are stored encrypted. Passkeys store only a public key.
- How we protect the rest of your data, and how to report a vulnerability: Security at Trakily.