Is two-factor login mandatory?

No. You turn it on yourself, in the app under Settings, Account or in the web dashboard.

Is two-factor login a Premium feature?

No. It does not depend on Premium status.

Which authenticator app do I need?

The app names Google Authenticator and Aegis as examples. You scan a QR code or type in the key by hand. The codes are generated on your phone and need no connection.

What do I do if my phone is gone?

Enter one of your backup codes when you sign in; they are the only way back into the account. With a backup code you can also turn two-factor login off and set it up again on the new device.

The email code does not arrive. What now?

A code is valid for ten minutes, and a code that was already sent stays valid. DriveBattle sends at most eight code emails per hour. A backup code always works.

How often do I have to enter a code?

At every sign-in with a password, in the app and in the browser.

How many wrong attempts are allowed?

Ten wrong codes within five minutes. After that, DriveBattle stops checking codes for that account for the time being.

Can I switch from the email code to the authenticator app?

Yes, by turning it off and setting it up again. You need your password and a current code for that.

Two-factor login: protect your account with an authenticator app or email code

With two-factor login, your password alone no longer signs you in. You also enter a code, either from an authenticator app or from an email. The feature is optional, works in the app and in the web dashboard, and is not a Premium feature.

Two ways to get the second factor

DriveBattle offers two methods. The authenticator app is marked as recommended in the app: it generates six-digit codes on your phone, for example with Google Authenticator or Aegis, and works without a connection. With the email code, DriveBattle sends a six-digit one-time code to your address at every sign-in. It is valid for ten minutes. There is no SMS code.

How to set it up

In the app, open Settings, Account and tap "Enable" under two-factor authentication. In the web dashboard, the same card is waiting after you sign in at drivebattle.com/login. You pick the method. For the authenticator app, you scan the QR code or copy the manual key; on the phone, "Open in authenticator app" launches the app directly. For the email code, the code arrives by email. The second factor only becomes active once you enter a valid code.

How signing in works afterwards

You sign in with your email address and password as usual. DriveBattle then asks for the code, in the app and in the browser. In the app you have five minutes for it. Instead of the code from the app or email, you can enter a backup code. A code from the authenticator app works once: a code that was already used is rejected, even while it is still displayed. The code fields in the Android app are connected to Autofill, so a password manager such as Bitwarden can fill them in.

Ten backup codes for emergencies

When you enable it, DriveBattle shows ten backup codes once, in the format 3F9A-7C2E. You can copy them all, share them, or tap a single one. Each code works exactly once. They are the only way back into your account if your phone is gone. The card shows how many are left and warns at two or fewer. You generate new codes with a current code, and the old ones become invalid.

How DriveBattle protects the second factor

The authenticator secret is stored encrypted in the database. Of the backup codes, DriveBattle keeps only hashes, never readable codes. Anyone who knows your password still gets nowhere: after ten wrong codes within five minutes, DriveBattle stops checking codes for that account. With the email code, sign-in sends at most eight emails per hour, so nobody can flood your inbox with codes. A deleted account that you reactivate within the 30 days only becomes visible after the second factor.

Turning it off or changing the method

To turn it off, you enter your password and a current code; a backup code works too. DriveBattle then deletes the secret and the backup codes. You set up a different method from scratch afterwards, there is no direct switch.

Frequently asked questions

Is two-factor login mandatory?: No. You turn it on yourself, in the app under Settings, Account or in the web dashboard.
Is two-factor login a Premium feature?: No. It does not depend on Premium status.
Which authenticator app do I need?: The app names Google Authenticator and Aegis as examples. You scan a QR code or type in the key by hand. The codes are generated on your phone and need no connection.
What do I do if my phone is gone?: Enter one of your backup codes when you sign in; they are the only way back into the account. With a backup code you can also turn two-factor login off and set it up again on the new device.
The email code does not arrive. What now?: A code is valid for ten minutes, and a code that was already sent stays valid. DriveBattle sends at most eight code emails per hour. A backup code always works.
How often do I have to enter a code?: At every sign-in with a password, in the app and in the browser.
How many wrong attempts are allowed?: Ten wrong codes within five minutes. After that, DriveBattle stops checking codes for that account for the time being.
Can I switch from the email code to the authenticator app?: Yes, by turning it off and setting it up again. You need your password and a current code for that.