Two-factor sign-in

What it is for

With two-factor sign-in on, signing in to ContactRoll asks for two things: your password, and a six-digit code from an authenticator app on your phone (Google Authenticator, Microsoft Authenticator, 1Password, or any app that shows six-digit codes that change every 30 seconds). A stolen password is then not enough to get in.

• Each member turns it on for themselves, on their own Settings page. It is theirs in every organization they belong to, as the other settings on that page are.
• An Owner can require it for everyone in the organization. A member who has not set it up is then asked to set it up the next time they open ContactRoll, before anything else.
• Ten backup codes, shown once when you set it up, let you sign in if you lose your phone.
• A member who loses their phone and their codes gets back in when an Owner resets their two-factor sign-in. The reset signs them out everywhere, is recorded, and the member is emailed.

Turning it on for yourself

1. Open Settings (/settings). Under Two-factor sign-in it says Off.
2. Press Set up two-factor sign-in. A QR code appears.
3. In your authenticator app, add an account and scan the QR code. If you can't scan it, press Can't scan it? Type this key instead and type the key shown into the app.
4. Type the six digits the app shows into Code from your app, and press Turn on.

Then ContactRoll shows Your backup codes: ten codes, such as 3k7pq-x9a2m, before anything else. Each works once, to sign in without your phone. Keep them somewhere safe, away from your phone — a password manager, or printed. Press Copy them to copy all ten, and I saved them when you have. They are shown this once: ContactRoll keeps only a fingerprint of each, so nobody — ContactRoll included — can show them to you again. If you lose them, make new ones (below).

The panel then says On. and "Two-factor sign-in is on. Next time you sign in, ContactRoll asks for a code from your app."

If the code is refused, the page says: "That code isn't the one your app shows now. Codes change every 30 seconds: type the one on the screen, and check your phone's clock is set automatically." Press Cancel to stop part way; nothing is turned on until a code has been accepted.

Signing in with it on

After your email address and password, ContactRoll shows Two-factor sign-in: "Type the six-digit code your authenticator app shows for {your address}." Type it and press Sign in. Nothing of your organization is shown or read until the code has been accepted.

If you arrived from an invitation link, the invitation is still waiting once you have given the code.

Backup codes

Under Two-factor sign-in on Settings, Backup codes says how many of your ten are left, when they were made, and when one was last used ("7 of 10 left, made Sep 1, 2026. Each works once, to sign in without your phone.").

To make new ones — when you have used some, or lost them — press Make new backup codes, type the code your app shows now, and press Make the codes. Your old codes stop working, and ContactRoll shows you ten new ones, once. New codes are made only just after a code from your app (within ten minutes of it): somebody with only your password cannot make them.

Signing in with a backup code

1. Sign in with your email address and password as usual.
2. On Two-factor sign-in, press Use a backup code.
3. Type one of your codes — capital or small letters, with or without the dash — and press Sign in with a backup code.

What happens:

• Your authenticator app stops working for your account, and you are signed out everywhere else — every other browser or phone where you were signed in. This browser stays signed in.
• Your other backup codes go too. When you set up your new phone, you get ten new ones.
• If your organization requires two-factor sign-in, ContactRoll asks you to set up your new phone straight away, before anything else. If it does not, you sign in with your password alone until you set it up again on Settings.
• You are emailed: "One of your backup codes was used to sign in to your ContactRoll account." — with what changed, and "If this wasn’t you, change your password now and tell an Owner of {organization}." The email never contains a code.

If the code is wrong or used already: "That isn’t one of your backup codes, or it was used already. Each code works once." After five wrong codes in fifteen minutes, ContactRoll takes no more for a while: "Too many backup codes were tried in a short time. Wait fifteen minutes, then try one again." If ContactRoll's sign-in service does not answer, nothing changes and the code you typed still works.

ContactRoll records every making of codes, every use and every wrong try — when, and which of the ten by its place in the list, never the code itself. Only the database reads that record and the codes' fingerprints: not you, not an Owner, not anyone at ContactRoll through the app.

Turning it off

1. On Settings, under Two-factor sign-in, press Turn it off.
2. Type the code your app shows now, and press Turn off.

It is turned off only with a code from the app: somebody who has only your password cannot turn it off. Your backup codes are forgotten with the app. If your organization requires two-factor sign-in, you are asked to set it up again the next time you sign in.

Requiring it for everyone (Owners)

On Team (/team), the Two-factor sign-in section tells every member whether the organization requires it. An Owner sees the switch:

1. Press Require it for everyone.
2. Read what it does — "Everyone who has not set it up is asked to, the next time they open ContactRoll, before anything else. Members signed in with a password alone are asked for a code. You need it on for yourself first." — and press Require it.

The section then says Required for everyone. Press Stop requiring it to switch it off again.

You need two-factor sign-in on yourself, and to have signed in with a code, before you can require it. If you have not, ContactRoll says: "Set up two-factor sign-in for yourself first, on Settings, and sign in again with a code: requiring it for everyone asks it of you too."

What was done lists, newest first, each time the requirement was switched and each reset, with who did it and when. Only an Owner sees it.

What "required" means

It is a rule of ContactRoll's database, not only of the screens. While an organization requires two-factor sign-in, a session that signed in with a password alone is answered nothing of that organization: no case, contact or file, no page, no export. A member who has it set up is asked for their code; a member who has none is shown Set up two-factor sign-in — "{organization} requires two-factor sign-in for everyone." — with the QR code, and nothing else until they have set it up. Sign out is on that screen too.

Another organization's setting never reaches yours: a member of two organizations, one of which requires it, works in the other with a password alone.

When a member loses their phone (Owners)

1. On Team, press the member's address to open their page (/team/{member}).
2. Under Two-factor sign-in, press Reset two-factor sign-in, then Reset {address}'s two-factor sign-in.

What happens:

• Their authenticator app stops working for their ContactRoll account, and their backup codes with it.
• They are signed out everywhere at once: every browser and phone where they were signed in. A page they have open shows nothing more of the organization, and the next time it is opened it is signed out — even a sign-in made a moment before the reset.
• They are emailed: "{you} reset your two-factor sign-in for {organization} on ContactRoll. The authenticator app you used before no longer works for your account." — then what happens next, and "If you didn’t ask for this, tell {you} and change your password."
• The reset is listed under What was done on Team: who reset whose, when, and how many apps were removed. The Owner's page says "{address}’s two-factor sign-in is reset, and they are signed out everywhere."

Next time they sign in, ContactRoll asks for their password only — and, where the organization requires two-factor sign-in, asks them to set it up again with their new phone before anything else.

Some things a reset will not do:

• Nobody resets their own this way. Your own is turned off on Settings with a code. If you lost your phone, ask another Owner.
• You must have signed in with your own code first. Otherwise: "Sign in with your own two-factor code first: resetting a colleague's is done from a session that used one."
• Only an Owner may. An Administrator is told "only an Owner resets a member's two-factor sign-in".
• Only a member of this organization.
• A member who had none set up is told as that: "{address} has no two-factor sign-in set up, so there was nothing to reset." Nothing is recorded or emailed.

If an organization's only Owner loses their phone, nobody in the organization can reset it, and ContactRoll has no button of its own for it yet: write to hello@contactroll.com.

Who may do what

Requiring it and resetting a member's are one permission, "require two-factor sign-in for everyone in the organization, and reset a member's when they lose their phone". It is the Owner's alone, as closing the account and transferring ownership are, so no role of your organization's own can hold it (see Roles).