What is changing?
Starting July 29, 2025, HackerOne will require two-factor authentication (2FA) for all platform users. Those who do not set up 2FA by this time will be locked out of their accounts.
2FA will be mandatory for all HackerOne users unless signing in using SSO/SAML.
Account recovery alerts will no longer require a phone number, but it can still be optionally configured
Backup codes are critical for access recovery in the event you lose access to your 2FA device
2FA setup will rely on TOTP-based apps (e.g., Google Authenticator, Duo Mobile)
How do I set up 2FA?
To set up 2FA on your devices, follow the instructions detailed here.
Why is 2FA now required for all researchers?
Security risk reduction: To better keep you and your vulnerability data secure. 2FA is standard across similar platforms. We’re aligning with those expectations to protect accounts and sensitive findings.
Government compliance: Programs operating within strict regulatory environments often cannot use SSO due to internal constraints and require robust, device-independent MFA enforcement.
Better account recovery: Recovery can be difficult if you’re ever in a restricted environment or without phone access. Enforcing platform-native 2FA provides a more reliable method for account access and support.
What does this mean for you?
2FA is now mandatory. If you do not set up 2FA by July 29, 2025, you will be prompted to complete the setup before accessing the platform and submitting reports. If you already use 2FA, you’re good to go.
Authentication methods will include time-based one-time password (TOTP) apps (e.g., Google Authenticator, Duo Mobile, etc.).
Account recovery will now be possible with backup codes only, reducing dependency on mobile access.
How does it affect my API submissions?
There will be no impact on report submissions via API.
What happens to my access to programs that require 2FA?
There will be no change for these programs.
I lost access to my backup codes. How can I recover my account?
It is paramount to ensure you maintain access to your 2FA device at all times. It is also your responsibility to securely store the backup codes we provide you. If you’re not sure where they are, we recommend following these steps to regenerate them now. In the unfortunate event that you lose access to both, please contact HackerOne support.
I lost the ability to reset the 2FA after providing a valid email and password. Why?
This is by design. However, you can access your account with one of the backup codes. If you do not have these, you can also contact the support team.
How often will I need to supply an authentication code? (Can I “remember this device”?)
You will be required to enter a time-based one-time password (TOTP) code each time you log in as part of the 2FA process.
Will I get a warning before I am forced to set up 2FA?
Yes, you will receive a number of notifications before you are forced to complete 2FA setup.