Skip to content
OrbixPanel OrbixPanel Tutorials

Two-factor authentication and account recovery

Two-factor authentication (2FA) means a stolen password isn’t enough to get into your panel — an attacker also needs the code from your phone. It’s the single best protection for your admin account.

Turn on 2FA

  1. In the panel, open your account security settings.
  2. Enable two-factor authentication.
  3. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.).
  4. Enter the 6-digit code to confirm.

Full walkthrough: Account security & 2FA.

Save your backup codes (do this now)

When you enable 2FA you’re given backup codes — one-time codes that log you in if you don’t have your phone. This is your recovery path, so:

  • Save them somewhere safe and offline — a password manager, or printed and stored securely.
  • Don’t keep them only on the same phone that has your authenticator — if you lose the phone, you lose both.
  • Each code works once; cross it off as you use it.

If you lose your authenticator

  1. Use a backup code to log in.
  2. Once in, disable and re-enable 2FA to pair a new device and generate fresh backup codes (the old ones stop working).

If you’ve lost both phone and backup codes

This is why the codes matter — recovery without them is hard by design (that’s the security). As the server owner, an admin with server/SSH access can reset 2FA at the system level. If you’re the server owner, keep your backup codes safe so you never need that path.

Good habits

  • Enable 2FA on every admin account, not just yours.
  • Re-generate backup codes if you ever suspect they leaked.
  • Pair 2FA with SSH keys and the hardening checklist.

Running OrbixPanel? 2FA with backup codes is built into the panel login. OrbixPanel.com → — the free, self-hosted, AI-powered hosting control panel.