Turn on two-factor authentication

Add a six-digit email code to every login, handle the login challenge, and turn two-factor off when you need to.

Updated September 2, 2026

Two-factor authentication is a second lock on your account. After your password, Hailo emails a six-digit code to your inbox, and you type it in to finish logging in. There is no authenticator app and nothing to scan: the code always comes by email.

Turn it on

  1. Open Settings > Account and find Two-factor authentication under Signing in. It reads "A second step at every login. We email a six-digit code to your inbox."
  2. Press Turn on. The Set up two-factor authentication page opens: "Two-factor auth is a second lock on your account. After your password, we'll email a six-digit code to {your email}. You type it in to finish logging in."
  3. Press Send me a test code. The page changes to Check your email with "We just sent a six-digit code to {your email}. It expires in 10 minutes."
  4. Open the email, then type the code into Enter the code and press Turn on two-factor.
  5. Your eight recovery codes appear, once. Save them before you leave the page. See Recovery codes.
  6. Press I've saved them, back to Account. The Two-factor authentication row now shows an On chip and the button reads Manage.

Reloading the setup page does not send another code. If the code did not arrive, press Didn't get it? Resend the code. Press Cancel to leave without turning two-factor on.

Logging in with two-factor on

  1. Enter your email and password as usual.
  2. The Two-factor verification page opens and a code is emailed to you automatically: "We just sent a six-digit code to {your email}. Enter it here to finish logging in."
  3. Type the code into Six-digit code.
  4. Tick Trust this device for 30 days, don't ask for a code here if this is your own Mac. See Trusted devices.
  5. Press Verify.

Codes expire after 10 minutes. Didn't get it? Resend the code sends a new one and shows "We sent a fresh code to {your email}. It expires in 10 minutes." Trouble? Start over at the top of the page returns you to the login screen.

If you have lost access to your email, type one of your recovery codes into the same box instead. The page reminds you: "Lost access to email? You can also enter a recovery code (like h3kf-9q2x) from the list you saved when you turned on 2FA."

On your own Mac, Use Touch ID on the login screen counts as the second step, so you are not asked for a code. See Touch ID.

Wrong codes and the lockout

Message Meaning
"That code didn't work. Try again, or use a recovery code." The code was wrong or expired. Check the newest email, or resend.
"Too many wrong codes. This account is locked for 15 minutes." Five wrong codes in a row. Wait 15 minutes.
"Too many wrong codes. Try again in about N minute(s)." The lockout is still running.

The lockout is on the account, not the device, so switching Macs does not get around it. Recovery codes are blocked during the lockout as well. After 15 minutes, request a fresh code and try again.

Manage two-factor

Open Settings > Account and press Manage on the Two-factor authentication row. The Two-factor authentication page shows:

  • Two-factor auth is on, with "When you log in, after your password we'll email you a six-digit code at {your email}. You type it in to finish." and, once used, "Last used {date and time} UTC."
  • Recovery codes: "You have N of 8 recovery codes left." with Generate new codes. See Recovery codes.
  • Turn off two-factor auth: "Re-enter your password to confirm. Disabling two-factor makes it easier for someone with your password to get into your account." with a Your password field and Turn off.

Turn it off

  1. On the Two-factor authentication page, type your password into Your password under Turn off two-factor auth.
  2. Press Turn off.
  3. You return to Account with "Two-factor authentication is now off."

Turning two-factor off also forgets every trusted device, everywhere you have signed in. The next login anywhere asks for your password, and if you turn two-factor back on later, each device has to be trusted again.

If it didn't work

Message What to do
"That code didn't match, or it expired. Try sending a fresh one." (setup page) Press Didn't get it? Resend the code and use the newest email. Codes last 10 minutes.
"Confirm your password to disable two-factor authentication." The password field was empty.
"Password didn't match. Two-factor auth is still on." Wrong password. Two-factor stays on. Try again, or reset your password first.
No email arrives Check spam and any filters on the address shown on the page. Resends are limited to five a minute. If nothing arrives after a few minutes, use a recovery code and then check the email on your account under Settings > Account.
  • Recovery codesWhere your eight recovery codes come from, how to use one when you cannot get the email code, and how to make a new set.
  • Trusted devicesSkip the two-factor code for 30 days on a Mac you trust, how the Mac app keeps that across relaunches, and what revokes it.
  • Log in with Touch IDSet up Touch ID on your Mac, use it alongside two-factor, and forget a Mac when you are done with it.
  • Reset your passwordGet a reset link from the login screen or from Account, choose a new password, and know what a reset does to your trusted devices.
  • Log out, and sign out everywhereWhat Log out does on the Mac app, and how to revoke every remembered device at once.
  • Your accountChange your profile picture, password, sign-in email and two-factor, manage this Mac, pick a theme and reach your data.
Still stuck? Send a note from the contact page and a real person at Hailo answers. Include the studio name you signed up with and, if it is about a specific screen, what you clicked.
Contact support