Why am I redirected to /auth/2fa-verify after login?

Last updated May 19, 2026Getting started

When you log in to Valid Email Checker and immediately get bounced to /auth/2fa-verify, it means you have two-factor authentication enabled on the account. Password alone is no longer enough — the second factor (a six-digit code from your authenticator app or a code we email you) is the next step before you land on the dashboard.

What the page is asking for

The page shows a single input field for a six-digit code, plus a link to use a backup code if you have one. Which kind of code it expects depends on which 2FA method you set up when you enabled the feature in Account Settings, Security tab:

  • Authenticator app 2FA (Google Authenticator, Authy, 1Password, or any TOTP-compatible app). The code rotates every 30 seconds. Open the app, find the Valid Email Checker entry, type the current code.
  • Email 2FA. We send a one-time code to your account email when you start the login. Open your inbox, copy the code, paste it here. The code expires after a few minutes — request a new one if it lapses.

After you enter the code

On success the page redirects to the dashboard at /overview. On a wrong code the field clears and you can retry. Repeated wrong codes trigger temporary rate-limiting on the IP — wait a few minutes and try again, or contact support.

You see the redirect but never enabled 2FA

Two possibilities:

  • You actually did enable it (sometimes during onboarding) and have forgotten. Check Account Settings, Security tab from another logged-in session if you have one open, or check your authenticator app for a "Valid Email Checker" entry.
  • Someone else has access to your account and turned 2FA on. This is a serious security flag — contact support immediately and we will help recover the account.

If you lost your authenticator device

Use a backup code on the same page (link near the code input). Backup codes are one-time-use; once a code is used it stops working. If you have no backup codes either, see what if I lose my authenticator for the recovery path.

Skipping 2FA on trusted devices is not supported
We do not offer a "trust this device" option that bypasses the 2FA prompt on subsequent logins. Every login on an account with 2FA enabled goes through the challenge page — this is a deliberate security tradeoff against the convenience of trusted-device bypass.