Two-step verification protects your sync account. With it on, signing in on a new device needs your master password and a six-digit code from an authenticator app.
It applies to your sync account, on servers that offer it. morphgate.com does. The reference server for self-hosting doesn't yet.
Turn it on
- Open Sync at the bottom of the sidebar.
- Under Account, choose Turn on two-step verification.
- Confirm with your master password and choose Continue.
- Scan the QR code with an authenticator app such as 1Password, Aegis or Google Authenticator. If you can't scan it, type the key shown under it.
- Enter the code the app shows, and choose Turn on.
On morphgate.com, your verified address gets an email when two-step verification is turned on or off.
Signing in
- When you sign in to sync on a new device, or sign in again after being signed out, MorphGate asks for the code after your master password.
- Devices that are already signed in keep syncing without codes.
- Each code works once. Use the newest one from your app.
- On your account page, signing in with an emailed link also asks for a code. Opening the account page from the app doesn't, because the app's sign-in already did.
- After a few wrong codes, the server makes you wait before you try again.
Turn it off
Under Sync, choose Turn off two-step verification, enter your master password and a current code, and choose Turn off. New devices then sign in with the master password alone.
Lost your authenticator
Your recovery key still gets you in. Using it to set a new master password also turns two-step verification off. Afterwards, turn it on again with your new authenticator. See Master password and recovery key.
Nobody at MorphGate can turn two-step verification off for you.
Teams that require it
A team can require two-step verification. If you don't have it on, you can still sign in and use your personal vault, but the team's vaults don't sync until you turn it on. The vaults already on your device stay there meanwhile, unsynced edits included. See Team policies.
What the server keeps
To check codes, the server must be able to read the authenticator secret. On morphgate.com it is stored encrypted, separately from your vault. It has nothing to do with your vault's keys: knowing it doesn't help anyone read your vault.