Help · Security

2FA (TOTP / Telegram)

Adds a 6-digit code to sign-in with email and password: from an authenticator app (TOTP) or sent to your linked Telegram. There are no backup codes, so keep the TOTP secret somewhere safe.

Open in the app All help topics
example
Sign in → password OK → 6-digit code
                          ↑
            authenticator app or Telegram

With 2FA on, signing in with your email and password also asks for a 6-digit code, so a leaked password alone is not enough.

Authenticator app (TOTP)

  • Any TOTP app works: Google Authenticator, Authy, 1Password and others.
  • In the Security section, click Enable next to Authenticator App, scan the QR code (or type the manual entry key), then enter your account password and a 6-digit code in the same panel: each setup makes a new QR code, and a code from an older one does not match.
  • It asks for your password so that a signed-in browser alone cannot add an authenticator of its own to your account. An account made through Telegram has no password, so it cannot use an authenticator app: it uses Telegram two-factor instead, the Telegram 2FA row of the same section.
  • From then on every email-and-password sign-in asks for a code, and turning it off needs a current code.

Telegram

  • Click Link Telegram, confirm with your password and press Open the bot: Telegram opens the ProofKit bot, @proofkitdvpn_bot, and pressing Start there links the account, within 5 minutes. In a chat with the bot you already have, send the /link line the panel shows instead.
  • Linking also switches Telegram 2FA on: each email-and-password sign-in then sends a 6-digit code to your Telegram. You can switch it off in the same section.

What it covers

Signing in with email and password. Once you are signed in, withdrawals and other actions do not ask for the code again.

If you lose your authenticator

There are no backup codes, and resetting your password by email does not turn 2FA off. Save the TOTP secret or QR code in a password manager when you set it up, so you can add it to a new device. Without it you cannot sign in with your password, and there is no self-service recovery: contact ProofKit through the Imprint & Contact page.