How do I make my bernard sign-in safer with a code from my phone?
Two-step sign-in adds a second check when you sign in to bernard. After your password or the code bernard emails you, bernard also asks for a 6-digit code from an app on your phone. A person who learns your password, or gets into your email, still cannot get in without your phone.
The prompt
“I want to turn on two-step sign-in for my bernard account. Tell me which app to use, where the setting is, and what happens if I lose my phone.”
Signed in, Get my prompt fills in your site for you. Otherwise press Copy and fill in the [bracketed] parts. First time? Connect your AI to bernard once: Use your own AI (opens in a new tab).
It is optional. Nothing changes until you turn it on.
Turn it on
- Put an authenticator app on your phone, for example Google Authenticator, Microsoft Authenticator or 1Password.
- In bernard, open Settings. Find the Two-step sign-in card, under Password.
- Press Turn on two-step sign-in. bernard shows a square picture (a QR code).
- In the app, add a new account and scan the picture. If you cannot scan it, type the key that is shown under the picture into the app instead.
- Type the 6-digit code that the app shows, and press Check code and turn on.
The card now says On. You stay signed in on this device. The next time you sign in, bernard asks for a code from the app after your password or emailed code.
If the code does not match, use the newest code the app shows. A code changes every 30 seconds. Make sure the time on your phone is set automatically.
Turn it off
Open Settings, type the code your app shows now into the Two-step sign-in card, and press Turn off two-step sign-in. bernard asks for a fresh code, not your password, so a person who finds your computer left signed in cannot turn the protection off.
If you lose your phone
Keep the app. If you lose your phone or delete the app, you cannot finish signing in, and an emailed code does not replace the code from the app. Email [email protected] from the address you sign in with. We check that the request is really from you, turn two-step sign-in off, and you can then set it up again on your new phone.
Some authenticator apps (1Password, Authy, Google Authenticator with a Google account) can keep a backup copy of your codes. If yours can, turn the backup on, so a new phone gets your codes back.
Changing or resetting your password
These work as before when two-step sign-in is on. If you reset a forgotten password from the email link, bernard asks for the code from your app before it shows the new-password form.
Two-step sign-in protects the door into your account. For what happens to changes once you are inside, and why nothing on your site goes live without you, see Is it safe to let an AI edit my site?. For signing in with an emailed code, see How do I sign in? I was emailed a code, not a password.
Questions people ask
- Do I have to turn on two-step sign-in?
- No. It is optional. If you never turn it on, you sign in the same way as before - with your password or a code bernard emails you.
- Which app do I need?
- Any authenticator app works. Google Authenticator, Microsoft Authenticator, 1Password and Authy are common ones. The app shows a new 6-digit code every 30 seconds, and it works without a phone signal.
- I started setting it up and stopped half way. Am I locked out?
- No. Two-step sign-in is only on after you type a code from the app and bernard accepts it. Until then, nothing about how you sign in changes. The next time you press the button, the unfinished set-up is cleared and you start again.
- What if I lose my phone or delete the app?
- You cannot finish signing in without a code, and an emailed code does not replace it. Email [email protected] from the address you sign in with. We check that the request is really from you before we turn two-step sign-in off, and then you sign in as before and can turn it on again with your new phone.
- Does two-step sign-in change how my site changes are approved?
- No. Changes to your site still wait on a draft until you approve them. Two-step sign-in only protects the door into your bernard account.
- Does everyone on my account have to use it?
- Not yet. Each person who signs in turns it on for themselves, in their own Settings. A setting that makes it required for everyone on an account is planned, but not available today.