Protect your account with two-factor authentication. QR Queen offers two methods: a code sent by email, or an authenticator app (TOTP). Each activation provides backup codes.
Steps (enable email 2FA)
Profile → "Sign-in & security" card.
Click to enable email 2FA: a 6-digit code is sent to you.
Enter the code you receive to confirm. 2FA only activates after this proof.
Note your 10 backup codes: they are shown only once.
Good to know
App method (TOTP): activation goes through a password verification, then a QR code to scan and a code to enter.
Changing method (email ⇄ app) asks for your password again; your existing backup codes stay valid. Disabling 2FA also asks for the password again.
Server-side security: codes are never stored in clear (only their sha256 hash), come from a cryptographic generator, expire after 10 minutes, and the token dies after 5 wrong attempts. Each backup code is single-use.
Email verification: when it is enforced by the administration (ENFORCE_EMAIL_VERIFIED variable), an unverified address cannot sign in (error EMAIL_NOT_VERIFIED).
---
