Glossary
What is Two-step sign-in (authenticator app)?
Two-step sign-in asks for a second proof after the password, often a six-digit code from an authenticator app that changes every 30 seconds.
Authenticator app codes follow RFC 6238, published in May 2011, which builds time-based codes on the HOTP algorithm of RFC 4226 and recommends a 30-second time step. The app and the server share a secret when you scan a QR code, and after that each side works out the same code from the time, with nothing sent over the network.
The NCSC ranks app-based code generators above message-based methods such as texted codes for organisations' own sign-ins. DSIT's Cyber Security Breaches Survey 2025/2026 found 47% of UK businesses had any requirement for two-factor authentication.
In CaptiFi Connect anyone on the team can switch it on under Settings with any standard authenticator app. Setup gives eight single-use recovery codes, shown once and stored only as hashes, so a lost phone doesn't have to mean a locked account.