Set up two-step verification or recover after losing your phone

Prepare before you start

Have an authenticator app and a safe place for recovery codes, separate from the phone you might lose. Two-step verification protects your personal GoodCompany account across companies. If setup asks for it, complete it before continuing.

Add an authenticator

1. Open Settings → Security → Manage two-step verification, or follow the setup prompt.
2. Enter Current password and choose Show setup QR code. If your account has no password and uses Google or Microsoft, leave the password blank and start within five minutes of signing in; sign in again if asked.
3. Scan the QR code in your authenticator app. If scanning is unavailable, enter the displayed setup key as a time-based account.
4. Enter the app’s current six-digit code and choose Verify if it has not submitted automatically. If enrollment expires, start again with a new setup code.
5. Save every recovery code in a password manager or a safe place offline. Each works once and the list will not be shown again. Select I have saved my recovery codes in a safe place. and continue.

Remember a computer carefully

Remember this computer for 30 days skips the authenticator challenge on that browser during its trust period. Use it only on a computer you control. It does not replace your password, provider sign-in or recovery codes. The Active sessions list is a list of signed-in sessions, not a list of every remembered computer.

Use a recovery code after losing your phone

1. Sign in with your password or usual Google/Microsoft option.
2. At the two-step challenge choose Use a recovery code instead.
3. Enter one unused saved recovery code and choose Verify. Mark that code as used in your saved copy.
4. After entering the workspace, return to Manage two-step verification. Choose Show replacement QR code, complete setup on your new device and save the new recovery-code list.

What replacement changes

The replacement becomes active after you confirm its authenticator code. It replaces the previous authenticator and recovery codes, signs out other sessions and clears earlier remembered-computer grants. Keep the new codes before leaving the page.

When verification fails

Use the newest code from the correct GoodCompany entry and check that the phone’s date and time are automatic. A code already used cannot be reused. If the page says too many attempts, wait for the stated lockout before retrying.

If you have no authenticator and no unused recovery code, check whether you still have a verified signed-in session from which to replace the authenticator. Otherwise, contact support about the access problem. There is no documented self-service email/SMS bypass or guaranteed support reset; a password reset does not remove two-step verification.