GOCOSYS Account Docs

Security & 2FA

Your password, two-factor authentication, and the recovery codes that get you back in.

Everything here lives on the Security page.

Change your password

  1. Enter your current password.
  2. Enter the new one twice. Minimum 8 characters, mixing letters, numbers and symbols.
  3. Save. The change applies immediately.

Changing your password does not end your other sessions. If you are changing it because you suspect someone else had access, use Sign out all other devices as well — see Devices & activity.

Two-factor authentication

The Security page: password, two-factor and active sessions.
The Security page: password, two-factor and active sessions.

Two-factor adds a 6-digit code from an authenticator app on top of your password, so a stolen password alone is not enough to sign in. Any TOTP app works — Google Authenticator, Authy, 1Password, Bitwarden.

Turning it on

  1. Choose Set up two-factor. A QR code appears.
  2. Scan it with your authenticator app, or type the secret in manually.
  3. Enter the 6-digit code the app shows, and choose Verify & enable.
  4. Save your recovery codes. They are shown once.

Setup is not complete until step 3 succeeds. If you scan the code but never verify, two-factor stays off — which is deliberate, so a mis-scanned code cannot lock you out.

Recovery codes

  • Each code works once.
  • Store them somewhere you can reach without your phone — a password manager, or printed.
  • They are your only self-service way back in if you lose your authenticator.
  • Run out, and only an administrator can restore access.

Turning it off

Choose Disable two-factor and confirm. Your account drops back to password-only, and existing recovery codes stop working. Turning it on again issues a new secret and a new set of codes — old ones are never reused.

Sign-in protection

  • Lockout. Repeated failed attempts temporarily lock the account, which blunts password guessing.
  • Rate limiting. Sign-in and sign-up are rate limited per minute.
  • Breached-password checks. Passwords known from public breaches are refused.
  • Sign-in alerts. Notable sign-ins generate an email so unexpected access is visible.
  • Bot protection. reCAPTCHA guards the public sign-in and sign-up forms.

If you think your account is compromised

  1. Change your password.
  2. Sign out all other devices.
  3. Turn on two-factor if it is off; if it is already on, disable and re-enable it to rotate the secret.
  4. Review Connected apps and revoke anything you do not recognise.
  5. Check login activity for unfamiliar sign-ins.