Signing in securely with two-factor authentication

Log in with a passkey, or verify with an authenticator app, SMS or backup code, and what to do if you lose your phone.

Two-factor authentication keeps your account safe: after your password, Improval asks you to prove it's really you. This article explains the ways you can do that, how to use a backup code, and what to do if you've lost or replaced your phone.

Ways to verify it's you

After you enter your password, you can verify with any method you've set up:

  • Passkey: confirm with your fingerprint, face or device PIN. Nothing to type, and you can use it to log in without your password too.
  • Authenticator app: enter the 6-digit code from an app such as Microsoft Authenticator, Google Authenticator, 1Password or Authy.
  • SMS: we text a 6-digit code to your phone.
  • Backup code: a one-off code for when you can't use any of the above.

You can manage all of these in Security settings.

Adding a passkey

A passkey lets you log in with your fingerprint, face or device PIN, with no password or code to type. Passkeys can't be phished, and if you use iCloud Keychain, Google Password Manager or a password manager, they're available on all your devices.

  1. Go to Security settings.
  2. In Passkeys, type a name you'll recognise, such as Work laptop or iPhone.
  3. Select Add a passkey.
  4. Follow your device's prompt to create the passkey.
Passkeys section in Security settings with a saved passkey and the Add a passkey button

On a shared or work computer that can't save passkeys, choose the option to use a phone. Your device shows a QR code to scan with your phone.

Logging in with a passkey

  1. On the log in page, select Log in with a passkey.
  2. Choose your passkey and confirm with your fingerprint, face, PIN or phone.

You're logged straight in, without your password or a code.

Many browsers also offer your passkey when you tap the Email box. Pick it from the list to log in.

Using a passkey after your password

If you log in with your email and password, Improval asks for your passkey first instead of a code.

  1. Select Use passkey.
  2. Confirm with your fingerprint, face, PIN or phone.
The Use passkey button on the verify your identity screen

To use another method instead, select Use authenticator app instead, Use SMS instead or Use a backup code.

Removing a passkey

  1. Go to Security settings.
  2. Select Remove next to the passkey.

You can't remove your only passkey unless you also have an authenticator app or SMS set up, so you're never left without a way to sign in.

Using a backup code

You get 10 backup codes when you set up two-factor authentication. Keep them in a password manager or somewhere safe. Each code works once.

  1. On the verify screen, select Use a backup code.
  2. Enter one of your codes, e.g. ABCD-2345, and select Verify.

We'll email you whenever a backup code is used, so you'll know if it wasn't you.

If you've lost or replaced your phone

After you sign in with a backup code, Improval asks whether you need to set up a new device. Choose what you need:

  • Set up a new authenticator app: scan a new QR code with your new phone.
  • Change my phone number: have codes texted to a new number.
  • Get new backup codes: replace your remaining codes with a fresh set of 10.
  • I still have my device, continue: carry on as normal.
Options shown after signing in with a backup code

You can also do any of these later from Security settings.

If you set up a new authenticator app, delete the old Improval entry from your app once the new one works. The old entry keeps showing codes, but they won't be accepted.

Getting new backup codes

If you've used most of your codes, or think someone may have seen them:

  1. Go to Security settings.
  2. In Backup codes, select Get new codes.
  3. Save the new codes. Your old ones stop working straight away.
Backup codes section in Security settings with the Get new codes button

My code isn't accepted

  • More than one Improval entry in your authenticator app? Use the one you added most recently, and delete the others.
  • Codes change every 30 seconds. Enter the code that's showing now, before it changes.
  • Locked out after too many tries? Wait 5 minutes and try again.
  • No access to any method? Use a backup code. If you don't have any, contact us.

Updated 12 October 2026