Skip to content
Wiki
Account and apps

Two-factor authentication

Protect your account with a one-time code, on the website and, if you want, when you join the server.

Updated on September 24, 2026 by joueur-1800bd0d2 min read
Contents

Two-factor authentication (2FA) adds a second check to your password: a 6-digit code, renewed every 30 seconds by an app on your phone. Even if your password leaks, nobody can get in without that code. On PVPFACTION, the same code can also protect your login to the game server.

Turning 2FA on for the website

  1. Install an authenticator app on your phone (Google Authenticator, Aegis, or any app compatible with "TOTP").
  2. On the website, open Settings › Security, Two-factor authentication (2FA) section, and click Enable 2FA.
  3. Scan the QR code with the app (or type the secret key shown if you can't scan).
  4. Enter the 6-digit code shown by the app to confirm.

The website then shows you 10 recovery codes.

Careful — Keep your recovery codes somewhere safe (password manager, paper). Each one works only once, and they're your only way out if you lose your phone.

From then on, every sign-in with e-mail and password asks for a code after your password. Signing in with a passkey doesn't: a passkey already counts as two factors (see Securing your account).

Requiring 2FA in game

Your Minecraft account must be linked. You can then ask for the same code to be requested when you join the server:

  • on the website: Settings › Security, "Require on the game server too" checkbox;
  • or in game: /2fa on (and /2fa off to stop).

2FA must first be active on the website: otherwise the server asks you to turn it on.

What happens when you join

When a code is required, you arrive in a waiting room: you can neither chat nor use commands until you type:

/2fa <code>

with the code from your app — or one of your recovery codes. Once validated, you join the world normally.

After a validation, your session is trusted for a while: you don't type a code on every reconnection. To force a new request on your next login (for example after playing on a computer that isn't yours), type /2fa logout.

In-game commands

CommandEffect
/2fa <code>Validates your two-factor authentication when it's requested.
/2fa on · /2fa offTurns the login code requirement on or off (same as /2fa game on / /2fa game off).
/2fa logoutEnds your trusted session: the code will be asked again on your next login.

Aliases: /2af, /twofa, /mfa. Your /profile also shows the state of your 2FA and your session.

Common problems

SituationSolution
"Invalid code"Check your phone's clock is set automatically: the codes depend on it.
"Too many attempts"Wait a few minutes before trying again.
Lost phoneUse a recovery code instead of the code, then turn 2FA off and on again with your new phone.
No phone and no recovery code leftContact the team (the Discord link is in the website footer).

Turning 2FA off

In Settings › Security, enter a current code (or a recovery code) to turn two-factor authentication off. The in-game requirement stops with it.

Going further