Help

Last updated 2026-07-29. A practical walkthrough of every feature in the service, in the order you are most likely to need them. If something here disagrees with what the page actually does, the page wins — this is documentation, not a contract.

1. Getting started

1.1 Sign up

New accounts are created at /signup. The signup form collects:

• Email. Used for login, password reset, invite notifications, and the verification link. We never share it with third parties (the only outbound mail is the five transactional categories listed on the Pricing page).
• Password. At least 12 characters; longer is fine. We hash it with a memory-hard algorithm and never store plaintext or any reversible form.
• Organization name. A workspace name for your team — you can rename or create more organizations later.
• Terms & Privacy agreement. Required checkbox, unchecked by default; you must opt in explicitly to comply with the GDPR & EU ePrivacy rules.

We also run a Cloudflare Turnstile challenge on the signup form. If the checkbox appears, click it; if your browser passes the passive checks, the form submits without a visible prompt.

After submission, your account, your organization, and your admin membership are created in a single transaction. If the verification email fails to send, the entire signup rolls back — you will not end up with a half-created account.

1.2 Verify your email

Within a minute or two, you receive an email with a magic link. Click it (or paste the URL into your browser) to confirm ownership of the address. The link is single-use, expires in 24 hours, and is bound to the address you typed at signup — if you mistyped, the link will not work and you can request a new one.

If the email never arrives, check your spam folder first, then wait 15 minutes and revisit /verify/pending — the page auto-sends a fresh link if the most recent one is missing or older than the cooldown. You can also use the manual "Resend" button (rate-limited to 3 per hour to prevent abuse).

1.3 Enroll your 2FA authenticator

After email verification, you land on /enroll. The page shows:

• A QR code encoding your unique TOTP secret in the standard otpauth:// format.
• The secret as plain text, in case you would rather type it into your authenticator manually or paste it into a desktop app like 1Password or Bitwarden.
• A live 6-digit code computed in your browser from the secret, rotating every 30 seconds with a per-second countdown — so you can confirm your authenticator app is wired up before submitting the form.

Open your authenticator app (Google Authenticator, Apple Passwords, 1Password, Bitwarden, Aegis, 2FAS, Authy — anything that speaks TOTP), scan the QR code or type the secret, then enter the 6-digit code your app shows into the form. Click Verify and continue.

The form accepts codes within a ±2-step window (about 60 seconds either side of the current step) to tolerate first-time clock drift between your phone and our server. After your first successful verification, the window tightens back to ±1 step for login.

If your scanner can't read the QR code (common on dark terminals or with printed pages), use the Upload tab in the scanner modal and upload the PNG file. The Enter manually block below the QR is the most reliable fallback — it never depends on a camera.

1.4 Save your recovery codes

On successful enrollment, you receive 10 recovery codes. Each is 10 lowercase-alphanumeric characters — about 1.7 × 10¹⁵ possibilities per code. They are shown exactly once, on the screen immediately after enrollment. Copy them to a password manager, print them and store the printout somewhere safe, or write them on paper and keep the paper in a secure location. Any combination works.

If you lose both your authenticator AND all your recovery codes, you cannot complete login. You will need to ask an organization administrator (or, as a last resort, the site operator) to recover the account — the recovery process wipes your password and re-enrolls your 2FA from scratch. See section 6.5.

Recovery codes are stored as one-way hashes — even the operator cannot recover the plaintext from the database. They are consumed atomically the first time each one is used. You can regenerate a fresh batch of 10 codes from your /profile page at any time (the old ones stop working the moment the new batch is generated).

1.5 Your first organization

Your signup creates one organization and makes you its administrator. The next thing to do is open the Dashboard and add a TOTP site. A "TOTP site" is a label + secret pair — for example, "AWS production console" + the secret you scanned from AWS's 2FA setup screen.

After your first site is in, the dashboard shows its current 6-digit code and starts counting down to the next rotation. That is the entire product: see a code, type it into the vendor's 2FA prompt, log in.

2. Daily use

2.1 Log in

Login is two-stage, in two separate requests:

1. Email + password at /login. On success, you receive a short-lived (5 minute) pre-2FA session and are redirected to the next step.
2. 6-digit TOTP code at /login/2fa. The code from your authenticator app; or a recovery code if your authenticator is unavailable.

A successful 2FA verification completes the login and drops you on the dashboard. You stay logged in across browser restarts until you click Sign out, change your password, or the session cookie expires.

If you check the "remember this device" box (when present in future builds), the second factor prompt is skipped on subsequent logins from the same browser for a longer period.

2.2 The dashboard

The Dashboard at /codes shows every TOTP code from every organization you belong to, grouped under a per-org header. Admins of an organization see a Manage sites, Manage members, and Audit log button in the org's section header; members see only the codes.

Each code row shows:

• The site label.
• The current 6-digit code, large.
• A progress bar showing time remaining until the code rotates.
• (Admin only) a small Delete button — confirmation prompt before the site is removed.

Click the code to copy it to your clipboard. Click the label to open the site's edit form (admin only).

2.3 Live refresh

The dashboard polls a JSON endpoint (/codes.json) every 30 seconds to fetch fresh codes. You don't need to refresh the page manually — when a code rotates, the page transitions smoothly to the next one with a brief flash of the progress bar.

If you keep the dashboard open in a background tab, it keeps polling even while you are not actively looking at it — the codes stay current, ready for whenever you come back.

2.4 Mobile and tablet

The Dashboard is responsive. On a phone, codes render one per row with the label above and the countdown below the digits. The clipboard-copy button is sized for thumbs. There is no native mobile app — the website is the app.

For the best mobile experience:

• Add the Dashboard to your home screen (iOS: Share → Add to Home Screen; Android: Menu → Add to Home Screen). It launches full-screen without the browser chrome, like a native app.
• Use Face ID / fingerprint to keep the session: mobile browsers typically preserve the session across restarts, so a quick glance-unlock is enough to see codes.
• Codes are not cached on the device. Every poll is a fresh HTTPS request. If your phone is offline, the last-known codes stay on screen but they may be expired — verify with the authenticator app before using.

2.5 Log out

Click Sign out in the navbar (top right). The session cookie is cleared immediately; the next request to any authenticated page redirects to /login. Logging out from a shared device is the simplest defense against shoulder-surfing and browser-history snooping.

3. Managing TOTP sites

3.1 Add a site

From the Dashboard, click Manage sites in the org header (admin only) and then Add a TOTP site. The form asks for:

• Label. A short, human-readable name like AWS prod, GitHub org, or Vendor X console. The label is what shows up on the dashboard; pick something that scans quickly.
• Secret. The base32 TOTP secret the vendor gave you. Most vendors display it as a QR code with a "Can't scan?" link to plain text; the plain text is what you paste here. The secret is encrypted before it hits the database — the database never sees plaintext.

Click Add site. The site shows up on the dashboard immediately, and its first 6-digit code appears within seconds.

3.2 Edit a site

Click the label of any site on the Dashboard to open the edit form. You can rename the site (the secret stays the same — the vendor doesn't need to know you renamed it) or replace the secret (if the vendor issued a new one). Saving the form updates the row in place; there is no need to delete and re-add.

Edits write an audit log entry with the previous and new values of any changed field (the secret itself is never logged — only its hash prefix, so two operators looking at the audit log can confirm "this secret was rotated" without seeing the secret value).

3.3 Delete a site

Click the small Delete button next to a site. A confirmation prompt asks you to type the site label (a defense against accidental clicks); on submit, the site is removed from the database and from the dashboard. The audit log keeps a permanent record of the deletion so the action is traceable.

Deleting a site does NOT delete the organization or affect any of the other sites. Members who lose access to a vendor through the deletion will need to use their own personal authenticator (or be re-added to a new site) to log in to that vendor going forward.

3.4 Team workflow

The intended workflow is:

1. An organization administrator sets up the account with the vendor and configures 2FA on the vendor side.
2. The admin adds the TOTP site to the Crew2FA organization, pasting the vendor's base32 secret.
3. All members of the organization can now log in to the vendor by reading the code off the dashboard. No one needs to scan the vendor's QR code on their personal phone.

This is the use case the service is built for: a small group of people (a startup team, a family IT admin group, a church volunteer team) sharing access to one or two vendor accounts that require 2FA. The organization is the tenancy boundary; nobody outside the organization can see its codes.

4. Managing members

4.1 Members list

Click Manage members in the org header on the Dashboard (admin only). The list shows every member's email and role (Admin or Member), with a remove / promote / demote button next to each row. New invites appear in a "Pending invites" section at the top.

You cannot remove yourself if you are the only administrator of an organization — promote another member to admin first, or create a new organization. This guard prevents a team from accidentally locking themselves out of their own shared codespace.

4.2 Invite a new member

Click Invite a member, type the email address, and submit. The system generates an 8-digit invite code, stores the code as a one-way hash, and emails the plaintext code to the address you typed. The email contains a deep link to /redeem with the code prefilled; the recipient clicks the link and finishes signup.

• The invite expires in 72 hours. If the recipient does not redeem it in time, the code is invalidated; you can issue a new one.
• The invite is single-use. A successful redemption marks the code consumed; a second click returns "invalid or expired".
• If the recipient already has a Crew2FA account, they can redeem the invite while logged in — they're added to your organization without creating a new account.
• If the recipient does not have an account, they complete signup in the same flow (email + password + terms agreement + 2FA enrollment), and the new account is automatically linked to your organization.

You receive an email notification when the invite is redeemed, and a separate email if it expires unused (both subject to per-user opt-out in your profile).

4.3 Roles: Admin vs. Member

Every member has one of two roles:

• Admin can add / edit / delete TOTP sites, invite and remove members, promote and demote, and view the audit log.
• Member can view codes and use the dashboard; nothing else.

Promote a member to admin by clicking Promote next to their row. Demote an admin to member by clicking Demote. Both actions write an audit log entry. There is no "Owner" or "Founder" tier — admins are equal.

4.4 Remove a member

Click Remove next to a member's row and confirm. The user's membership row is deleted (their account itself is preserved — they keep their own TOTP, their own recovery codes, and any other organizations they belong to). They immediately lose access to your organization's codes on their next dashboard refresh.

This is a soft remove — you can re-invite the same email later, and the existing account will join your organization again. If you want to permanently block an email, contact the site operator.

4.5 Audit log

Every state-changing action in an organization writes one row to the audit log: who did what, when, from which IP, with a JSON metadata blob. The audit log is accessible from Audit log in the org header (admin only) and shows the most recent 200 rows.

What gets logged per organization:

• Site creation, edit, deletion.
• Invite issuance, redemption, expiration.
• Member add, remove, promote, demote.

Site administrators (a separate, platform-wide role) can view the global audit log across all organizations. Members of an organization cannot see the org-level log — only admins do.

5. Invites

5.1 Sending an invite

From Manage members, click Invite a member and enter the recipient's email. The system mints an 8-digit numeric code, hashes it, and emails the plaintext to the address. The email contains a single deep link that drops the recipient on /redeem with the code prefilled.

The recipient does NOT need to know the code separately; the link carries it. If the link breaks (email client strips query params, the recipient manually copies just the domain), they can type the 8 digits into the redeem form by hand.

5.2 Redeeming as a new user

If the recipient has never used Crew2FA, the redeem flow walks them through:

1. Email + password + terms agreement (same as signup).
2. Cloudflare Turnstile challenge.
3. Email verification (one magic link).
4. 2FA enrollment (QR + 6-digit code).
5. Recovery codes shown once.
6. Redirected to the dashboard, now a member of the organization that invited them.

If the SMTP send fails at any point, the entire transaction rolls back — the invite is un-burned and the partial account is deleted. The admin who issued the invite can re-send a fresh one with one click.

5.3 Redeeming as an existing user

If the recipient already has a Crew2FA account and is logged in, the redeem form is a single field: the 8-digit code. Submit adds them to the inviting organization as a member (or admin, if the inviting admin marked the invite as admin-level).

If they are not logged in, they enter their existing email + password on the same form; the system verifies their 2FA in the background (their existing session cookie carries the verified status) and links them to the new organization.

5.4 Invite expiry

Every invite expires 72 hours after issuance. The hourly cleanup sweep marks expired, unconsumed invites and emails the issuing admin (unless they opted out in their profile). The recipient sees "invalid or expired" if they try to redeem an expired code.

The cleanup sweep also handles a specific edge case: if someone redeems a code but never verifies their email and never enrolls 2FA, the resulting half-account is purged after 24 hours of grace, and the invite is un-burned so the legitimate recipient can try again.

5.5 Notification opt-out

Admins who issue invites can opt out of the lifecycle notifications (issued, redeemed, expired) from their /profile page. The toggle is per-user and applies to all invites they will ever issue. Site administrators have the toggle visible but the application layer ignores it — they always receive notifications.

Opting out does not affect any other transactional email (verification, password reset, password-changed heads-up).

6. Account & security

6.1 Using a recovery code

A recovery code works in place of the 6-digit TOTP code at the second login stage. Type the 10-character alphanumeric string into the code field at /login/2fa instead of the rotating digits. The code is consumed on first use — you cannot reuse it.

Each successful login with a recovery code triggers a flash message reminding you to visit /profile and regenerate a fresh batch. With 10 codes and one used per "lost authenticator" incident, you should always have plenty left — but a fresh batch after every use is the safe default.

6.2 Regenerate recovery codes

From your /profile page, click Regenerate recovery codes. The page asks you to confirm with your password (a defense-in-depth check against an attacker who briefly sat down at your unlocked browser). On confirm, the 10 old codes are deleted and a new batch of 10 is generated and shown once.

The old codes stop working the moment the new batch is generated. If you saved the old codes to a password manager, update the entry. If you printed them, destroy the printout.

6.3 Reset your password

If you still have your authenticator (or at least one unused recovery code), self-service reset is available:

1. From /login, click Forgot password? Enter your email; you receive a reset link within a minute or two (the page always shows the same success flash to prevent email-enumeration; if no account matches, the reset is silently not sent).
2. Click the link in the email. The reset page (/password/reset/<token>) asks for a 6-digit TOTP code OR a recovery code — you must prove you still control the second factor before the password can be changed.
3. After step 1 succeeds, you see the new-password form. Type and confirm your new password. Submit completes the reset atomically: password changed, all other sessions force-logged-out, heads-up email sent to you.

The reset link expires in 1 hour (shorter than the 24h verification link, because password reset is higher-stakes). After 5 wrong TOTP / recovery code attempts, the link is superseded and the flow restarts from step 1.

6.4 Account lockout

After 10 consecutive failed login attempts (wrong password, wrong TOTP, wrong recovery code), the account is locked for 15 minutes. The lockout releases automatically — you do not need to contact anyone. The counter resets on the next successful login.

Lockout is per-account, not per-IP — an attacker rotating IPs cannot bypass it. Rate limits per IP are separate (and lower: signup is 5/hour, login is 10/minute with a 30/hour ceiling) and apply regardless of whether the requests target real accounts.

6.5 If you lost both authenticator AND recovery codes

Self-service reset cannot help you — step 1 of the reset flow requires either a valid TOTP or a valid recovery code. Without either, the only path forward is an organization administrator (or, for site-level issues, the site operator) running an account-recovery flow on your behalf.

What the administrator can do:

• Send you a fresh recovery email that walks you through email-verification → 2FA re-enrollment → new-password setup, in three steps.
• The administrator does NOT see or choose your new password — you type it yourself in step 3.
• The administrator does NOT see your old password — the password hash is one-way; the admin only knows they wiped it.
• All existing TOTP sites, organization memberships, and recovery-code history are preserved; you pick up exactly where you left off, with fresh credentials.

If you do not have an organization admin who can help, contact the site operator via /about/abuse with your account email and a short description. Response time is best-effort.

6.6 Profile preferences

From /profile you can:

• Change your password (requires the current password).
• Regenerate recovery codes (requires your current password).
• Toggle invite-event notifications (whether you receive the issued / redeemed / expired emails for invites you issue). Site administrators have the toggle visible but the application layer always sends them notifications.
• Switch theme (light / dark / auto). The choice is stored in your browser's local storage; it is not transmitted to the server.
• Sign out of all sessions (force-log-out every browser currently authenticated as you).

Your profile does not show your TOTP secret, your recovery codes (those are one-time), or any organization data beyond your own memberships. If you need to inspect your own account state for debugging, use the in-product "Account details" section.

7. Troubleshooting

7.1 Lost your authenticator

Phone died, factory-reset, switched platforms. Two paths back:

1. Restore from backup. If you saved the secret text or exported your authenticator's data before the loss, install the same app (or any compatible app) on the new device, paste the secret, and the codes reappear identically.
2. Use a recovery code at /login/2fa (see section 6.1). After successful login, visit /profile and re-enroll 2FA on the new device with a fresh secret.

If neither path works (no backup, no recovery code), follow section 6.5.

7.2 Lost your recovery codes

If you still have your authenticator, log in normally and visit /profile to regenerate a fresh batch of 10 codes (see section 6.2). The old batch is invalidated the moment the new one is generated.

If you do not have your authenticator either, follow section 6.5.

7.3 Verification or reset email never arrived

Walk this checklist:

1. Check the spam folder. Legitimate transactional email gets caught occasionally, especially on first contact.
2. Wait 15 minutes and revisit /verify/pending or re-trigger the reset from /login. The page auto-resends on cooldown; the manual resend button is rate-limited but always available.
3. Check the From address: messages come from no-reply@crew2fa.com. Make sure your mail provider does not silently drop mail from that sender.
4. Make sure your mailbox is not over quota. A full mailbox rejects incoming mail without bouncing; some providers report the rejection to the sender, but many do not.
5. Try a different email address if you have access to one. The service does not require a specific provider; any working mailbox works.

If the above does not resolve the issue, contact the site operator via /about/abuse with the email address you signed up with and the approximate time of the request.

7.4 Invite code does not work

Most likely cause: the code expired (72-hour TTL). The issuing admin sees an expiry notification; you can ask them to issue a fresh one.

Second most likely: a typing error. The code is 8 digits — if you typed it manually instead of clicking the link, double-check each digit. The form will tell you if a code is "invalid or expired" but won't tell you which one (to prevent enumeration of valid codes).

Third: the invite was already consumed. Each code is single-use. If the recipient who clicked the link first is someone other than you (a forwarded email, a mistyped address), the code is gone and you need a new one from the admin.

7.5 Login keeps failing

A small checklist:

• Time sync. TOTP codes are time-based. If your phone clock is more than a minute or two off, every code you generate will be rejected. Enable auto time-sync in your phone's settings; on a desktop authenticator, sync to an NTP server.
• Wrong account. If you have multiple Crew2FA accounts (different email addresses), make sure the email at the login form matches the one your authenticator was enrolled against. The 6-digit code is account-specific.
• Wrong app / wrong entry. If you have multiple TOTP entries in the same app, make sure you are reading the one labeled Crew2FA (or whatever you named our entry) and not some other service's entry.
• Recovery code instead. If your authenticator is genuinely unavailable, use one of your 10 recovery codes (see section 6.1).

After 10 failed attempts, the account locks for 15 minutes (see section 6.4). Wait it out and try again; this is by design.

7.6 A TOTP site is "stuck" (wrong code, vendor says invalid)

Most common cause: the vendor rotated their 2FA secret on their side and the old secret in your Crew2FA site is no longer valid. The vendor does not tell you when they do this — they just start rejecting your codes.

Fix: open the site in the edit form (click the label), paste the new secret the vendor gave you (you will need to re-do their 2FA setup flow to get a fresh QR / text), and save. The dashboard shows the new code within seconds.

If the vendor rotates secrets often (some do, most don't), consider whether you want to keep using Crew2FA for that account or fall back to a personal authenticator app that the vendor's rotation emails will reach directly.

7.7 Still stuck?

For non-security bugs (UI quirks, missing feature, unclear wording), email bug_report@crew2fa.com. For security issues, see /security. For abuse from another user or organization, see /about/abuse.