Two-factor authentication (2FA) in the panel

Two-factor authentication (2FA) adds a one-time code from an authenticator app on your phone to signing in to the app.blackbox.md panel. You set it up on the “Security” page (app.blackbox.md/security): in the left menu, section “Account” → “Security”, or in the user menu (top right) → “Security & 2FA”.

Available to: any customer with access to the panel. For customers, 2FA is optional.

What the “Security” page shows

The “Two-Factor Authentication” block shows the current status:

How to enable 2FA

You need an authenticator app on your phone, for example Google Authenticator, Authy or 1Password.

Important Once 2FA is enabled, you cannot turn it off in the panel: there is no button for that. Have your phone ready, and a safe place for the recovery codes, before you start.

1. Open “Security” and click “Enable Two-Factor Authentication”.
2. The “Set Up Authenticator” section appears. Scan the QR code with the app. If you can't scan it, add the key shown under “Manual entry key” to the app by hand, as a time-based key.
3. The app shows a “BlackBox” entry with your email address, for example BlackBox:name@example.com.
4. Save the 8 recovery codes shown below the message “Save these recovery codes in a safe place. Each can be used once if you lose access to your authenticator.” The “Copy All” button copies all of them, one per line. Each code is 8 characters long: digits and the letters A–F.
5. In the “Verification” section, enter the 6-digit code the app shows right now.
6. Click “Confirm & Enable”. The button becomes active once you have entered 6 digits.
7. The panel takes you to the “Overview” page. On the “Security” page, “Status” now shows “Enabled” and “Recovery codes remaining” shows 8.

If the code is not accepted, the field is cleared and an error message appears (for example “Invalid code”). Check the time on your phone and enter the new code from the app.

Recovery codes cannot be shown again later; they can only be regenerated. If you leave the page before step 6, 2FA stays disabled, and the next time you try you get a different QR code, a different key and different codes. In that case, delete the old entry from the app: it will no longer work.

Tip Keep your recovery codes offline and separate from your phone: in a password manager, or printed and stored in a safe place. If you lose both your phone and your codes, you will usually have to contact support to regain access to the panel.

How to sign in to the panel after enabling 2FA

From now on, every sign-in to the panel asks for the code:

1. Sign in as usual: from blackbox.md (see Opening the app.blackbox.md panel from your account) or directly (see Signing in directly to app.blackbox.md).
2. The “Two-Factor Authentication” step appears with the message “Enter the 6-digit code from your authenticator app.”
3. Enter the code in the “Authenticator Code” field.
4. If you came from blackbox.md, you can select “Remember this device for 30 days” (details below).
5. Click “Verify”.

You must complete this step within 5 minutes and in no more than 5 attempts; after that, start signing in again from the beginning. A code that has already been used is not accepted a second time: wait for the next code in the app (codes change every 30 seconds). The “Back” button takes you back to the username and password form.

With a recovery code

1. On the “Two-Factor Authentication” step, click “Use recovery code instead”.
2. Enter one of your 8-character codes in the “Recovery Code” field. Uppercase and lowercase letters are treated the same.
3. Click “Verify”.

Each code works only once. To go back to the code from the app, click “Use authenticator code instead”. If you have neither your phone nor any codes left, read Lost your 2FA device: it also explains the “Lost 2FA device?” link.

“Remember this device for 30 days”

This checkbox appears only when you sign in from blackbox.md. If you select it, your next sign-ins from blackbox.md in the same browser will not ask for the code for 30 days. When you sign in directly at app.blackbox.md/login, the code is always required. Do not select it on a shared or public computer.

The code is required again if:

• 30 days have passed;
• you sign in from a different browser or device, or you have cleared your browser's cookies;
• the panel password was changed or reset in the panel;
• 2FA was reset;
• “Settings” → “Sign Out Everywhere” was used;
• sometimes, after a browser update.

Changing your password on blackbox.md does not cancel remembered devices. Use “Sign Out Everywhere” for that.

Error messages at the 2FA step

How to regenerate recovery codes

Regenerate your codes when only a few are left, or if you suspect that someone else has seen them.

1. Open “Security”. “Status” must be “Enabled”.
2. Click “Regenerate Recovery Codes”.
3. Enter your password in the “Current password” field. If you sign in to the panel from blackbox.md, this is your blackbox.md account password.
4. Click “Regenerate”.
5. 8 new codes appear, with the message “Save these recovery codes in a safe place. They will not be shown again.” Save them, for example with “Copy All”.

From this moment, your old codes no longer work. If the password is wrong, an error message appears (for example “Invalid password”). The “Cancel” button closes the form.

Accounts created only with Google or GitLab don't have a panel password, so they can't regenerate the codes themselves. Write to support@blackbox.md from your account's email address: support can reset 2FA, and then you enable it again and get 8 new codes.

Turning off 2FA

There is no button in the panel to turn off 2FA. If you want to turn it off, write to support@blackbox.md from your account's email address (see How to contact BLACKBOX support). Support verifies your identity before resetting 2FA. After the reset, all your panel sessions end, and you can enable 2FA again at any time.

Frequently asked questions

The code from the app is rejected every time. What should I check? Make sure your phone sets its time automatically: the codes depend on the time. Enter the code shown right now, not one that has just expired or that you have already used.

I'm changing phones. How do I move 2FA? Move the “BlackBox” entry to your new phone with your authenticator app's transfer or sync feature before you give up the old phone. You can't set up 2FA again in the panel while it is enabled. If the app can't transfer entries, ask for a 2FA reset (see Lost your 2FA device), then enable it again on the new phone. Until then, you can sign in with your recovery codes.

I lost the laptop on which I selected “Remember this device for 30 days”. Sign in to the panel from another device and use “Settings” → “Sign Out Everywhere”: all panel sessions end, and remembered devices will ask for the code again. Also change your password on blackbox.md so that your sessions there end too. Details in Panel settings: profile, password, and sessions.

I selected “Remember this device for 30 days”, but I'm still asked for the code. The checkbox works only when you sign in from blackbox.md, and only in the same browser. Check the list in the “Remember this device for 30 days” section above.