Two-factor authentication adds a second verification step at login, beyond your password. Even if your password is compromised, an attacker can't get into your account without the code from your authenticator app.
2FA is available on the web app, the iOS app, and the Android app.
Setting Up 2FA on Web
Go to Account → Personal Information — the Two-Factor Authentication section is at the top of the page
Click Enable Two-Factor Authentication
Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, or any TOTP-compatible app)
Enter the 6-digit code from your app to confirm
Setting Up 2FA on Mobile
Open the Hello Hotel app
Go to your profile and tap Security
Tap Enable Two-Factor Authentication
Follow the prompts to link your authenticator app
Confirm with a 6-digit code
Using 2FA at Login
After 2FA is enabled, every login asks for your authenticator code after your password. The code rotates every 30 seconds — use the current one.
2FA Delivery for Admin Login
When an admin signs in, Hello Hotel can deliver the 2FA challenge code via three channels:
Authenticator app (recommended) — the most secure option, doesn't depend on phone or email reachability
SMS — the code is texted to the phone number on file for that admin
Email — the code is emailed to the address on file for that admin
SMS and email are useful as a fallback when an admin doesn't have an authenticator set up, or when they've lost access to their authenticator app and need to log in quickly. The authenticator app stays the safer choice for day-to-day use.
If You Lose Access to Your Authenticator
If you lose your phone or your authenticator app and can't sign in, contact your organization admin, or reach out to us to verify your identity and reset 2FA — use the chat widget in this help center or on hellohotel.co, or email us at [email protected].
Tips
Use an authenticator app, not SMS. Authenticator apps are more secure than SMS-based 2FA because they don't depend on your phone number being available.
Enable 2FA on every account that supports it. Hello Hotel, your email, your PMS, your bank — 2FA is one of the highest-leverage security steps you can take.