Two-step sign-in

Two-step sign-in protects your ZestSSH account. Signing in also asks for a six-digit code from an authenticator app, so someone who learns your password, or gets into your Google or Apple account, still cannot sign in as you.

It works with any authenticator app that reads a QR code: Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden, Aegis, Authy and others.

Two-step sign-in is a free feature for every ZestSSH account.

Note

This protects your ZestSSH account. For codes that an SSH server asks for when you connect, see Keyboard-Interactive.

Set it up

On a phone or a tablet:

1. Open Profile > Security and choose Set up next to Two-step sign-in.
2. Sign in again to confirm it is you.
3. Scan the QR code with your authenticator app. On a phone you can also choose Open in authenticator app; an app that cannot scan takes the key shown under the code instead.
4. Enter the six-digit code the app shows and choose Turn on.
5. Save your recovery codes (see below), then choose Done.

On a computer (Windows, macOS or Linux): open Profile > Security and choose Open zestssh.com, or go to zestssh.com/account/security directly. Sign in there and follow the same steps.

Firebase, which runs ZestSSH sign-in, also emails you when an authenticator is added, with a link to remove it if it was not you.

Signing in

After your password, or Google or Apple, ZestSSH asks for the code your authenticator app shows now. Codes change every 30 seconds; a code from a moment ago still works.

Signing in again to confirm a change (signing out a device, deleting the account) asks for the code too.

Recovery codes

When you set up two-step sign-in, ZestSSH gives you ten recovery codes, like 7k2mq-x9d4t. They are for the day you lose your authenticator: a new phone, a wiped phone, a lost phone.

• Each code works once. Using one turns two-step sign-in off for your account, and all your other codes stop working with it. Sign in as before, then set two-step sign-in up again with a new authenticator.
• They are shown only once. Copy them into a password manager, save them as a file, or print them, and keep them apart from your phone.
• ZestSSH emails you whenever a recovery code is used. If it was not you, change your password (or secure your Google or Apple account), set two-step sign-in up again and choose Sign out everywhere under Profile > Devices.
• New codes replace the old ones at once: Profile > Security > Recovery codes > New codes.

To use one: at the code prompt, choose Lost your authenticator? Use a recovery code, check your email address and enter the code. Spaces, dashes and capital letters do not matter.

Turn it off

Open Profile > Security and choose Turn off next to Two-step sign-in, then confirm and sign in again. Your recovery codes stop working. On a computer, turn it off at zestssh.com/account/security.

Things to know

• A code alone signs no one in. A recovery code only turns two-step sign-in off; signing in still needs your password, Google or Apple.
• Lost both your authenticator and your recovery codes? Then two-step sign-in cannot be turned off, and the account cannot be signed into. ZestSSH does not remove it on request, since anyone can write an email claiming to be you. Keep your recovery codes somewhere safe, apart from your phone.
• Your synced data is separate. Two-step sign-in protects the account. Your synced hosts and keys stay encrypted with your sync password, which ZestSSH never has.
• What ZestSSH keeps: only a keyed hash of each recovery code, never the codes themselves, and never your authenticator’s secret: that is held by Firebase Authentication, which checks the codes. Nothing records when you sign in or use a code.