Two-factor authentication for your myPandos account
Two-factor authentication means a stolen password alone is not enough to reach your account. Here's how to turn it on and which methods myPandos supports.
Your myPandos account controls your domains, your hosting, your invoices and your payment details. Two-factor authentication (2FA, also called multi-factor authentication or MFA) adds a second step at sign-in, so a leaked or guessed password on its own gets an attacker nowhere.
Where to find it
Sign in at dash.mypandos.io, open Profile from the account menu, and select the Security tab. The Security Overview at the top tells you at a glance whether two-factor authentication is currently enabled.
The methods you can use
Multi-factor methods are managed by myPandos SSO, our single sign-on service. Under Multi-factor authentication, choose Add method and pick one:
| Method | What it is | Good to know |
|---|---|---|
| Authenticator app | A 6-digit code from an app such as Google Authenticator, Microsoft Authenticator, 1Password or Authy | The best all-round choice; works offline |
| Passkey or security key | Your device's fingerprint/face unlock, or a hardware key | The most phishing-resistant option |
| Recovery codes | Single-use codes to fall back on | A backup, not a primary method — store them somewhere safe |
Adding a method opens an enrolment window from the sign-on service. If nothing appears, your browser has blocked the pop-up — allow pop-ups for the site and try again.
Set up at least two methods
An authenticator app plus recovery codes (or a passkey) means losing your phone is an inconvenience rather than a lockout. The dashboard will not let you remove your last remaining method for exactly this reason — add the replacement first, then remove the old one.
Confirming it's you
Changing multi-factor settings asks you to confirm your identity first — a “Confirm it's you” prompt appears. If you sign in through myPandos SSO (almost everyone does), it sends you a one-time code by email, WhatsApp or SMS; only accounts that sign in with a local myPandos password are asked for that password instead. That confirmation is valid for a short window and then expires, so an attacker who finds an unattended, already-signed-in browser still cannot weaken your 2FA.
Email one-time codes
The dashboard also offers email one-time codes as an additional factor, under the backup methods on the same Security tab. They are better than nothing, but an authenticator app or passkey is stronger — if your email account is what gets compromised, an emailed code protects you far less.
Your password
You can change your password on the same Security tab. It must be at least 8 characters — make it longer and unique to myPandos, ideally generated by a password manager. Changing it:
- signs you out of your other devices,
- removes every remembered (trusted) device, so the next sign-in on each one asks for 2FA again,
- and sends you a confirmation email.
If you ever get that confirmation email and it was not you, treat it as an emergency — contact us immediately.
Staff and admin accounts
Accounts with administrative access cannot disable multi-factor authentication, and cannot change their password from the dashboard. That is deliberate hardening, not a fault.