> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/end-user-guide/managing-your-mfa.md).

# Managing your MFA

Multi-factor authentication adds a second proof of identity beyond your password. It is what keeps your account safe if your password is ever stolen — which is why most organisations require it.

You manage your own methods from the Self-Service Portal. Register more than one where you can, so losing a device does not lock you out.

## Authenticator app codes (TOTP)

The portal shows a QR code. Scan it with the SECUREpass Authenticator — Google Authenticator and Microsoft Authenticator also work — then type the first code it generates to confirm the pairing.

Save your backup codes somewhere safe at the same time. They are what gets you in if you lose the phone.

## Push notifications

Pair the SECUREpass Authenticator app and you can approve a sign-in with a single tap instead of typing a code.

Only approve a push you were expecting. A prompt arriving when you are not signing in means someone else has your password — reject it and tell your IT team.

## Biometrics

You can enrol a fingerprint on a device that supports it, or register your face for facial recognition.

Biometrics are among the strongest methods available and the quickest to use day to day — there is nothing to type and nothing to carry.

## Your mobile number

Adding your mobile number lets SECUREpass send you a one-time code by SMS. It is the most convenient method and the weakest of the ones here, so treat it as a fallback rather than your main method where you have a choice.

## Using the SECUREpass Authenticator app

One app covers several sign-in methods: time-based codes, push approvals, GRID card challenges and QR scan.

1. Download and install it from your app store.
2. Register with your email or username, and verify with the one-time code you receive.
3. Set your in-app unlock — a PIN, a fingerprint or a facial scan.

After that the app is ready to generate codes, approve push prompts, scan QR codes and answer GRID challenges.

## If you lose your phone or key

Sign in with another registered method and remove the lost device from your list straight away.

If it was your only method, contact your IT help desk. They can restore your access and help you enrol a new device. Tell them the device is lost rather than just asking for a reset — a lost authenticator is a security matter, not an inconvenience.