Setting up two-factor authentication (MFA)

Two-factor authentication adds a second step to your sign-in: even if someone has your password, they also need your phone (or authenticator app) to get in. We strongly recommend enabling it for your MemoryBank account.

How to set it up

1. Sign into mymemorybank.app/dashboard.
2. Open Settings in the sidebar (or go to /dashboard/settings).
3. Find the Security section.
4. Click Enable two-factor authentication.
5. Pick your preferred method:
   • Authenticator app (recommended) — Google Authenticator, 1Password, Authy, etc. You'll scan a QR code with the app and enter the 6-digit code it generates.
   • SMS — a one-time code is sent to your phone number every time you sign in. Less secure than an app but easier if you don't use an authenticator.
6. Save your backup codes somewhere safe (a password manager is ideal). These get you back into the account if you lose your phone.

What changes after enabling

• The next time you sign into MemoryBank, you'll enter your password AND a 6-digit code from your authenticator (or SMS).
• Your kid devices and any saved sessions are NOT signed out. Existing pairings keep working — MFA only affects new parent-side sign-ins.
• If you sign in from a new device or browser, MFA is required even if you've signed in there before.

Removing or changing MFA

Open /dashboard/settings → Security. You can disable MFA, switch authenticator methods, or add a backup method. Disabling MFA requires you to be currently signed in — that's intentional, so nobody can disable it from outside.

I lost access to my authenticator

If you have your backup codes, sign in with one — each code is single-use. Then re-enroll a new authenticator from settings.

If you don't have the backup codes either, contact support. Account recovery requires identity verification and can take 1-2 business days; we deliberately make it slow so it's a hard path for an attacker to exploit.

Do my kids need MFA on their devices?

No. The kids dashboard is authenticated via the device pairing flow, not a password. There's nothing for a kid to sign in to — they just use the device. MFA only protects the parent admin account.