# Turn on two-step login

To turn on two-step login, open **Settings › Security › Security**, make sure your alternate email is filled in, switch on **Enable 2-Step Authentication** and click **Update**. From then on, after your password XgenPlus asks for a one-time code sent to your alternate email. You can turn it off again on the same page.

## How to turn on two-step login

1. Click your profile picture, choose **Settings** and open **Security**, then the **Security** tab.
2. Check that **Alternate E-mail ID** is filled in and correct.
3. Switch on **Enable 2-Step Authentication**.
4. Click **Update** and confirm with the verification code if asked.
5. At your next sign-in, enter the code you receive and click **Verify**.

## When to use it

> Sunita, the CFO at acme.in, turns on two-step login. Even if a phishing mail tricks her into revealing her password, nobody can open her mailbox without the code sent to her alternate email.

## Options

| Option | What it does |
|---|---|
| **Enable 2-Step Authentication** | Asks for a one-time code after your password at every sign-in. |
| **Don't ask code here for Today or 7 Days** | Trusts this browser for the chosen period. Use it only on your own computer. |
| **Resend Code** | Sends a fresh code if the first one did not arrive or has expired. |

## Good to know

- The code screen shows your alternate email partly masked, so you know where the code went.
- If a code expires, XgenPlus sends a new one to the same contacts.
- If you delete all your recovery contacts from your security settings, two-step login is switched off.
- Want to skip the password altogether? Use **Secure Login Via APP** with the XgenPlus mobile app.
- Mail apps such as Outlook cannot show the code screen. Give them an app password instead.

## Common questions

**I can't see Enable 2-Step Authentication. Why?**

Your domain administrator has not allowed it yet. Ask them to turn on **Allow Dual Authentication** for your domain.

**Do I have to enter a code every time?**

On the code screen you can tick **Don't ask code here for** **Today** or **7 Days**. That browser then skips the code for the period you chose.

**Does the email code need a mobile message service?**

No. The code goes to your alternate email, so two-step login works without any mobile message service.

**Can I use the Web Login code from the XgenPlus app?**

Yes. The code screen also accepts the Web Login code from the XgenPlus app.

**The code did not arrive. What now?**

Check the spam folder of your alternate mailbox, then click **Resend Code**. It becomes available a few seconds after the first code.


Source: https://docs.xgenplus.com/security/turn-on-two-step-login/