> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/authentication-and-identity/two-factor-authentication-2fa.md).

# Two-Factor Authentication (2FA)

Two-factor authentication (2FA) adds a second credential to the web login flow, so a stolen password alone is not enough to access an account.

2FA protects interactive web sign-in. FTP, FTPS, SFTP, SCP, and WebDAV clients do not present ExaVault's interactive 2FA prompt. Use a separate, least-privileged workload account for unattended transfers, and use [SSH key authentication](/connection-methods/sftp/ssh-key-authentication.md) for SFTP when possible.

## Require 2FA

An administrator can open *Admin Settings > Passwords* and enable *Require all users to use Two Factor Authentication (2FA)*. This setting is available when the appliance license includes 2FA.

When the requirement is enabled, a user without a registered method must enroll during the next password-based web sign-in. Before requiring 2FA, confirm that outbound email works and enroll at least one administrator. Email is needed for email verification and recovery codes.

The ExaVault enrollment requirement is part of its password-login flow. A SAML sign-in does not use that flow. Require multi-factor authentication in the identity provider for users who sign in through SSO.

## Set Up or Change 2FA

Open your User Profile and select one of the supported methods. Changing the method replaces the previously registered device and generates a new set of recovery codes.

### Authenticator App

Choose the authentication-app method, scan the QR code with a TOTP-compatible app, and enter the current code. Authenticator apps do not depend on SMS delivery or on access to the user's email inbox during each sign-in.

TOTP depends on accurate time. If valid-looking codes are rejected, enable automatic time synchronization on the device running the authenticator app and try a newly generated code.

### SMS Through Twilio

SMS requires a customer-managed Twilio account. On the Appliance Manager *Configuration* page, enter *Twilio Account SID*, *Twilio Auth Token*, and *Twilio From Phone Number*. The From number must use E.164 format, such as `+1234567890`. Save the configuration and [restart the appliance](/administration/restarting-the-appliance.md).

The user must then select SMS in their User Profile and enter a destination number. Numbers beginning with China's `+86` country code are not supported by the current ExaVault SMS configuration.

### Email Verification

Email verification sends a one-time code to the email address on the user's ExaVault account. The code is valid for 15 minutes. Configure and test [outbound email](/administration/sending-email.md) before users depend on this method.

Email verification is weaker than an authenticator app because the verification code and password-reset messages can arrive in the same inbox. Prefer an authenticator app when users can support it.

## Recover Access

ExaVault creates ten one-time recovery codes when a user enrolls or changes 2FA. On the verification screen, select *Lost phone? Request one-time recovery code*. ExaVault emails the next available recovery code to the address on the user's account. A recovery code stops working after it is used.

If all recovery codes have been used, or the user cannot access the account's email address, contact an ExaVault administrator before attempting further account changes. Administrators cannot retrieve a user's TOTP secret or used recovery codes.

## Troubleshoot 2FA

For any failure, first confirm that the username and password are accepted and that the user is enabled and not expired. Use [Activity Search](/authentication-and-identity/investigating-login-failures.md) to distinguish a password or account-state failure from the second-factor failure.

For an authenticator app, correct the device clock and use the newest code. For email, confirm that the user record has the correct email address, then follow [Troubleshooting Emails](/administration/sending-email.md#troubleshooting-emails). For SMS, verify the Twilio credentials and From number, then check Twilio's message logs for rejection, carrier filtering, or regional restrictions. The appliance service logs can also show a Twilio delivery error.

If a user changes from one method to another, discard the old QR code and recovery codes. Only the newly registered method and newly generated recovery codes remain valid.