Two-Step Login on Tanzahost: Passkeys, App Codes, Recovery

A stolen password should not be enough to open your Tanzahost account. Every login to Tanzahost takes two steps, and this guide shows you how to set them up on your own account. By the end you will have a passkey on your devices, an authenticator app as the second step for your password, and recovery codes saved somewhere safe.

This is the whole login security picture in one place: /docs/account/login-security.

The two steps, and what counts as each

A passkey is the easiest option: your fingerprint, your face or your screen lock. It counts as both steps, so no code is ever needed. With a password, the second step is a code: from your authenticator app if you added one, otherwise a 6-digit code we email you, valid for 15 minutes.

Two details worth knowing. Right after you sign up, the code that proved your email counts as your second step, so you are not asked twice. From your next login on, you are. And once you add an authenticator app, it replaces the emailed code: someone who reaches your email still cannot log in.

What you need before you start

• An account you can log in to, with a password of at least 15 characters. A short sentence works well, like my shop opens at eight.

• A device with a fingerprint reader, face unlock or screen lock, for the passkey.

• An authenticator app on your phone, like Google Authenticator or 1Password, for the 6-digit codes.

• A place to keep recovery codes, like a password manager or a printed page at home.

• A login from the last 15 minutes. Changing a password, a passkey or the second step needs a login that recent.

A password that appeared in a known data leak on another website is refused. Text messages are never used as a second step, because phone numbers can be stolen.

Example: Asha secures her shop

Asha first signed up with a password. Her shop takes real money now, so she opens Security, adds a passkey on her phone and another on her laptop, and from then on logs in with her fingerprint. She keeps her password too, with the authenticator app as its second step and her recovery codes in her password manager, for the day she has to log in from a borrowed laptop.

Steps

Open the Security page

1. Open your profile menu in the top bar.

2. Choose Security. This is where you manage how you log in, where you're logged in, and your login history.

Add a passkey

1. On Security, choose Manage how you log in. For your safety, you may be asked to log in again.

2. Under Passkeys, choose Add a passkey, and follow your device.

3. Repeat on each device you use, or keep one passkey in a password manager that syncs. A passkey can live on this device, your phone, a password manager or a security key.

From then on, the passkey logs you in with your fingerprint, face or screen lock, and it counts as both steps.

Turn on the authenticator app

1. In Manage how you log in, under Authenticator app, scan the code with your app, or type in the key.

2. Type the 6-digit code the app shows, and choose Turn on.

From then on, after your password, the login asks for the app's code instead of an emailed one.

Make recovery codes and save them

1. Still in Manage how you log in, choose Make recovery codes.

2. Save them somewhere safe, like a password manager or printed at home. Each code logs you in once, instead of the app.

Lost your phone? On the login page, choose Use a recovery code instead and enter one.

Check where you are logged in

Security lists each browser and device with an open login: what it is, when it logged in and when it was last used.

• Log out ends one login.

• Log out everywhere ends every login to your account, on every device, this one included.

You stay logged in for 30 days on each device unless you log out. The first time someone logs in to your account from a device we haven't seen, we email you. That alert is always on.

Read your login history

Login history lists logins, tries that failed, and every change to how you log in: a new passkey, a new password, the app turned on or off. Each line shows the device and roughly where it was.

Something you don't recognise? Choose Log out everywhere, then change your password or add a passkey.

What to check that it worked

1. Log out, then log in with your password. You should be asked for the app's 6-digit code, not an emailed one.

2. Log out again and log in with your passkey. It should ask for your fingerprint, face or screen lock and let you straight in, with no code at all.

3. On Security, confirm both passkeys are listed under Passkeys, and your phone is listed under Authenticator app.

4. Open Login history and check the logins and changes you just made are there, with the right device.

5. Try one recovery code on a device where the app is not available, so you know the codes work before you need them. Remember, each one works once.

Mistakes people make and how to fix each

Changing how you log in and getting asked to log in again. Not a mistake: changing a password, a passkey or the second step needs a login from the last 15 minutes. The same applies to closing the account. Log in again and repeat the step.

Registering a domain and hitting a second check. A registered domain asks for more: unlocking it, changing its nameservers or its owner's details, or showing its transfer code need your passkey or your second step from the last 15 minutes. That way a stolen session, or a stolen password alone, cannot do them.

Adding only one passkey and losing that device. Add one on each device you use, or keep one in a password manager that syncs.

Turning on the app but skipping recovery codes. If you lose your phone and have no codes, you have no second step. Choose Make recovery codes right after you turn the app on, and store them somewhere that is not your phone.

Using a password that showed up in a leak. It is refused. Pick another of at least 15 characters, like a sentence.

Waiting for a text message. It never arrives, because text messages are never used as a second step. Use the app, or a code by email if you have no app.

Losing the emailed code. It is valid for 15 minutes. If it expires, start the login again to get a new one.

Forgetting the password. On the login page, choose Forgot your password? and type your email. If it has an account, a 6-digit code arrives, valid for 15 minutes. It lets you set a new password or add a passkey. To open the rest of your account, finish with your second step as usual.

A login you don't recognise. Choose Log out everywhere, then change your password or add a passkey. Too many failed logins pause password login for a while, and logins are slowed per account and address together, so people sharing one mobile network's address aren't locked out together.

Noticing the login page never tells you whether an email has an account. That is deliberate. The login page answers the same whether an email has an account or not, so nobody can find out who has one.

Worried a Google or GitHub login could take over your account. It joins an existing account only after you log in the usual way first, so a look-alike email can't take it over.

Next

• Turn on two-step login step by step: /help/turn-on-two-step-login

• The full picture of the two steps, ways to log in, active logins and login history: /docs/account/login-security