Two-factor authentication means a password alone is not enough to sign in. After the password step, Finthy asks for a 6-digit code that only your phone can produce. It is the single most effective thing you can do to protect the account.
Read the section on losing access before you turn it on. Finthy has no override.
Turning it on
- Open Settings from the main menu.
- Go to the Security tab.
- Find Two-Factor Authentication and click Enable Two-Factor Authentication.
- Step 1: Scan QR Code. Scan the code with your authenticator app. Any app that supports standard TOTP codes works; the screen suggests Google Authenticator and Authy, and 1Password, Bitwarden and Microsoft Authenticator work just as well. The QR code is the only way to enrol: there is no typed setup key to fall back on, so use an app that can read a QR code from your screen or from a screenshot.
- Step 2: Save Backup Codes. Save the ten codes somewhere you will still have them if your phone is gone. This is the only time they are shown.
- Step 3: Enter Verification Code. Type the 6-digit code your app is showing and click Verify and Enable.
You will see Two-factor authentication has been enabled successfully. Until you finish step 3, nothing is turned on, so closing the page halfway leaves the account exactly as it was.
The code in your app changes every 30 seconds. Finthy accepts the code either side of the current one, so a phone clock that is slightly off is not a problem.
Signing in once 2FA is on
You enter your email and password as usual, then land on Two-Factor Authentication, which says Enter the 6-digit code from your authenticator app or a backup code. Type the code into Authentication Code and click Verify.
A wrong code gives Invalid authentication code. Please try again. The code may simply have rolled over while you typed; wait for the next one.
The password step and the code step are one sign-in. If you leave the code screen sitting too long, you will be sent back to the password step with Your sign-in expired. Please log in again. Nothing is wrong with the account.
Your backup codes
- There are exactly ten, each in the form
XXXX-XXXX. - They use only letters and digits that cannot be confused with each other, so there is no capital O against a zero, or capital I against a one, to get wrong.
- Each one works once. Using a code removes it, leaving nine, then eight, and so on.
- Type a backup code into the same Authentication Code box you would use for an app code.
Finthy stores only hashes of your backup codes, so they cannot be shown to you again. If you did not save them, generate a new set while you still have access to your authenticator app: Regenerate Backup Codes in the same Security section, confirmed with your current password. That will invalidate all existing backup codes and generate new ones, which is exactly what you want if you think the old list has been seen by someone else.
Watch the count. If you are down to your last code or two and your phone is the only other way in, regenerate now rather than later.
What 2FA changes elsewhere in the account
Turning 2FA on signs out every other session and disconnects any apps or AI assistants you have connected to Finthy. Those sessions and connections were established without the second factor, so they do not survive it. You will need to sign in again on your other devices and reconnect anything under Connected apps.
The same happens when you turn 2FA off and when you regenerate your backup codes. Each of those changes which keys open the account, so everything holding an old key is cut loose.
Turning it off
Disable Two-Factor Authentication, in the same Security section, asks for your current password and warns that This will make your account less secure. Confirm with Disable. Your authenticator entry and all remaining backup codes are deleted, so turning 2FA back on later means scanning a fresh QR code and saving a fresh set of codes.
Moving to a new phone works the same way: there is no “replace my authenticator” button. Turn 2FA off, then turn it on again and scan the new QR code. Between those two steps the account has no second factor, so do it in one sitting, with the new phone already in your hand.
If you lose your authenticator app
Use a backup code. That is what they are for: one of them gets you in, and from there you can set up 2FA again on your new phone.
If you have lost your authenticator app and your backup codes, be clear about what that means. There is no code, no security question and no support override that gets past the second factor. Finthy staff cannot turn 2FA off on your account; the tools simply do not have that control, by design, because a support channel that can remove 2FA is a way around 2FA. Resetting your password does not help either: a reset changes the password and leaves 2FA on.
Two things do get you back in, and both have to be set up in advance:
- A backup code. Keep them somewhere separate from your phone.
- A passkey. A passkey signs you in on its own, without the password step and without the code step, so a passkey added today is a second route in tomorrow.
If neither exists, the account cannot be opened again. You can still exercise your data rights: write to support from the account’s email address and ask for an export or for the account to be deleted. We verify who you are before acting on either.
Passkeys are not a second factor
This trips people up, so plainly: a passkey is a complete sign-in, not an extra step. A passkey proves both that you have the device and that you can unlock it, which is why Finthy does not ask for your 2FA code after a passkey sign-in. Adding one gives you a second way in; it does not add a second lock to the way you already had.
That is a reasonable trade and it is how passkeys are designed to work, but it does mean the security of a passkey sign-in is the security of your device unlock. Keep your device lock on.
To add one: Settings > Security > Passkeys > Add a passkey, confirmed with your current password, then follow your device prompts. You can name it, and the name is only for you to tell them apart. You can hold up to twenty, and you can rename or remove any of them from the same section.
Finthy emails you whenever a passkey is added or removed, so an addition you did not make does not pass quietly.
Passkeys work in the web app on browsers and devices that support them. If yours does not, the sign-in page says Your browser does not support passkeys. Native-app passkeys are on our roadmap.