Skip to content

Use two-step verification

Two-step verification adds a second step after your password when you sign in, so someone who learns your password still can't open your login. You confirm it's you with one of:

  • An authenticator app (recommended): an app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password, shows a 6-digit code that changes every 30 seconds.
  • Emailed codes: we email a 6-digit code to the address on your login each time you sign in. Use this if you can't use an authenticator app.

Either way you also get ten recovery codes for when you can't use your app or email.

Your company may require two-step verification for company admins, or for everyone. If it does, you're asked to set it up the next time you sign in. If it doesn't, you can still turn it on yourself.

Set it up when you sign in

If your company requires it and you haven't set it up yet:

  1. Sign in with your username and password as usual.
  2. We email a 6-digit code to the address on your login. Enter it on Confirm it's you and select Continue. (If you just accepted an invitation, you skip this step: the invitation link already confirmed your email.)
  3. Choose Use an authenticator app or Email me a code each time.
  4. For an authenticator app, scan the QR code with the app (or select Can't scan? Enter this key instead and type the key), then enter the 6-digit code the app shows and select Turn on two-step verification.
  5. Save your recovery codes (see below), then select I saved my codes, continue. You're signed in.

Sign in with two-step verification

  1. Enter your username and password and select Sign In.
  2. Enter the 6-digit code from your authenticator app, or the code we just emailed you, and select Verify.

An emailed code works once and expires after 10 minutes. Select Email me a new code if it doesn't arrive; only the newest code works. An authenticator code works once: if you sign in again straight away, wait for the app to show the next code.

If you enter five wrong codes, you're asked to sign in again. After many wrong codes or code emails, you see Too many attempts: wait an hour and try again.

Recovery codes

When you turn on two-step verification, you see ten recovery codes, once. Keep them somewhere safe, such as a password manager. If you lose your phone or can't get your email, enter one of them instead of a code on the sign-in page. Each code works once. After you use one, the portal tells you how many you have left.

Change or turn off two-step verification

Select Two-step verification near the bottom of the portal sidebar. You see whether it's on, which method you use, and how many recovery codes you have left. To make a change, first enter your password and select Confirm password. If two-step verification is off, we also email you a 6-digit code: enter it and select Continue. Then:

  • Change method (or Turn on two-step verification): set up an authenticator app or emailed codes, as above. Your old method keeps working until the new one is confirmed.
  • Get new recovery codes: shows ten new codes. Your old codes stop working.
  • Turn off: only shown if your company doesn't require two-step verification.

Lost your phone and your recovery codes?

Contact EEHM. After confirming who you are, EEHM can reset two-step verification for your login. You then sign in with your password, and, if your company requires it, set it up again.

If you get a code email you didn't ask for, someone may know your password. Reset your password from the sign-in page and tell EEHM.