Skip to main content

🔑 Two-Factor Authentication (2FA)

What is two-factor authentication?​

Two-factor authentication (2FA) adds a second step to signing in to FormNX. After you enter your email and password, FormNX asks for a 6-digit code from an authenticator app on your phone. The code changes every 30 seconds.

Someone who steals or guesses your password still can't get in without your phone.

Why you should turn it on​

Your FormNX account holds every submission your forms have collected: names, emails, phone numbers, addresses, uploaded files, signatures and payment records. It also holds connections to tools like Stripe, PayPal, Google Sheets and your email provider.

A password alone is often not enough to protect that:

  • Passwords get reused. If you use the same password on another site and that site is breached, attackers will try it on other services, including FormNX.
  • Passwords get phished. A fake login page can capture your password. It can't capture a code that expires 30 seconds later.
  • You're protecting other people's data. If your forms collect personal information, keeping your account secure is part of your responsibility under privacy laws like GDPR.

What you need​

  • An authenticator app on your phone. Any app that supports standard time-based codes (TOTP) works, for example:
    • Google Authenticator
    • Microsoft Authenticator
    • Authy
    • 1Password, Bitwarden or another password manager with one-time codes
  • Your FormNX password.
Signed up with Google or Facebook?

You need a FormNX password before you can turn on 2FA. Go to My profile → Edit profile, set a password, click Update, and then follow the steps below.

How to enable two-factor authentication​

  1. Open your profile. Click your name or avatar in the top-right corner and choose My profile.
  2. Find the Two-factor authentication card below Edit profile. Its status shows Disabled.
  3. Click Set up.
  4. Scan the QR code with your authenticator app. The app adds FormNX and starts showing a 6-digit code.
    • Can't scan? Click Show code for manual configuration, copy the key and enter it in your app by hand.
  5. Enter the 6-digit code your app is showing right now.
  6. Enter your FormNX password.
  7. Click Next.
  8. Save your recovery codes. FormNX shows 8 one-time recovery codes. Click Download codes and keep the file somewhere safe, then click Done.

The card now shows Enabled. You stay signed in on the device you used to set it up.

Save your recovery codes now

Recovery codes are shown only once. If you lose your phone and don't have these codes, you won't be able to sign in. Store them in a password manager, or print them and keep them somewhere safe. Don't keep them only on the phone that runs your authenticator app.

Signing in with 2FA​

  1. Sign in with your email and password as usual, or with Google or Facebook.
  2. FormNX asks for your authentication code.
  3. Open your authenticator app and enter the 6-digit code shown for FormNX.
  4. Click Verify.

A few things to know:

  • Each code works once. If a code is rejected, wait for the next one to appear in your app and try again.
  • Check your phone's clock if codes keep failing. Codes are based on the time, so a phone clock that's a few minutes off will produce wrong codes. Turn on automatic date and time in your phone's settings.
  • After 5 wrong codes, FormNX pauses sign-in attempts for about a minute to block guessing.
  • Wrong account? Click Sign in with a different account below the code box to go back to the login page.
  • One code per sign-in. Once you're in, FormNX won't ask again until you log out or your session ends.

Lost your phone? Use a recovery code​

If you can't open your authenticator app, enter one of your recovery codes in the same box where you'd type the 6-digit code, then click Verify. Recovery codes look like AB3CD-EF7GH.

  • Each recovery code works only once. After it's used, it's removed from your list.
  • Once you're back in, turn 2FA off and set it up again on your new phone. If you've used several codes, get new ones.

If you've lost both your phone and your recovery codes, contact FormNX support.

Get new recovery codes​

Used some of your codes, or think someone may have seen them? Make a fresh set:

  1. Go to My profile and find the Two-factor authentication card.
  2. Click Regenerate backup codes.
  3. Enter your password and confirm.
  4. Download the new codes and keep them safe.

Your old recovery codes stop working as soon as new ones are created.

How to turn off two-factor authentication​

  1. Go to My profile and find the Two-factor authentication card.
  2. Click Disable.
  3. Enter your password and confirm.

2FA is switched off, and the FormNX entry in your authenticator app no longer works. You can delete it from the app. If you turn 2FA on again later, you'll scan a new QR code and get new recovery codes.

Moving to a new phone​

Your authenticator app's codes don't move to a new phone on their own, unless your app has cloud backup or sync (like Authy, Microsoft Authenticator or a password manager). To move FormNX to a new phone:

  1. While you're still signed in to FormNX, go to My profile and Disable 2FA. Only your password is needed for this.
  2. Click Set up again and scan the new QR code with the app on your new phone.
  3. Save the new recovery codes.

Frequently asked questions​

Is two-factor authentication required?​

No. 2FA is optional, and you turn it on for your own account. We strongly recommend it for anyone whose forms collect personal or payment information.

Does 2FA affect my forms or the people filling them in?​

No. 2FA only protects signing in to your FormNX account. Your published forms, embeds and respondents work exactly as before.

Does it work if I sign in with Google or Facebook?​

Yes. After Google or Facebook signs you in, FormNX still asks for your 6-digit code. You need to set a FormNX password once to turn 2FA on.

Does 2FA affect the API or my integrations?​

No. Integrations that connect with an API token aren't asked for a code, so they keep working after you turn on 2FA.

Does FormNX send codes by SMS or email?​

No. FormNX uses authenticator app codes, which are more secure than SMS. They can't be intercepted over the phone network or through a SIM swap, and they work without a phone signal.

I see two FormNX entries in my authenticator app. Which one is right?​

Use the newest one. Older entries are left over from an earlier setup and won't work. You can delete them from the app.