2FA – Two-factor authentication
A password you know, plus a code from the phone you carry with you.
Two-factor authentication protects your account even if someone steals your password. You can set it up in a few minutes and this guide walks you through every tap – with examples of what you will see on your phone and in Artists Bez Labelu.
Two-factor authentication (2FA for short) means that you log in to Artists Bez Labelu with two things instead of one – your password and a six-digit code from an app on your phone. The code changes every 30 seconds, so it cannot be guessed, spied on or used twice. Anyone who does not have your phone in their hand cannot get into your account, even if they know your password.
Why we have it
Passwords leak far more often than people like to admit. All it takes is for the same password you use with us to leak from any other website – an attacker then automatically tries it everywhere you have ever registered. And a Bez Labelu account is not just a list of songs:
Royalties and bank account
Anyone who gets into your account can change the payout account number and have your royalties sent to themselves.
Your music
They can remove releases from platforms, overwrite metadata or release someone else’s content under your name – and you will bear the consequences.
Personal data
Your account holds your real name, address, phone number and contract documents. For fraudsters, that is a valuable bundle of information.
With two-factor authentication, a stolen password is useless on its own. That is why we require it for accounts that money flows through – and strongly recommend it to everyone else.
Who it is mandatory for and who it is optional for
| Who | 2FA | Why |
|---|---|---|
| Label accounts | Mandatory | They manage the music and royalties of several artists at once. |
| Artists with total royalties of CZK 3,000 or more | Mandatory | An account that money has already flowed through is the most attractive one for attackers. What counts is the total of all royalties accounted to you over the entire time, not your current balance. |
| Other artists | Optional | We recommend turning it on straight away, even if you don’t have to yet. Setup takes a few minutes and your account is then safe from the start. |
The requirement is evaluated every time you log in. As soon as your royalties exceed the threshold, the app will show you the setup page by itself the next time you log in.
You can postpone the setup three times using the “Not now, I’ll set it up later” link. You can see how many postponements you have left right in the link text. On the fourth login, the app will no longer let you continue without setting it up. Users for whom 2FA is mandatory also cannot turn it off in their profile – those for whom it is optional can turn it off and back on at any time.
How it works
The phone app needs neither the internet nor a SIM card – it calculates the codes by itself from a secret key and the exact time. It sends nothing anywhere, you don’t connect it to your Bez Labelu account and you won’t receive any text messages.
Step 1 – Install an authenticator app
An authenticator app is an ordinary free phone app that shows you six-digit codes. You get it the same way as any other app – from the app store that came with your phone:
The store is called Google Play and has a colourful triangle icon. Open it, type the name of the app into the search bar at the top and tap Install.
The store is called the App Store and has a blue icon with a white letter A. Search for the name of the app and tap Get. The built-in password manager can also generate codes (in iOS 15 to 17 under Passwords in Settings, from iOS 18 as the standalone Passwords app) – then you don’t need to install anything at all.
Which app should you choose? It doesn’t matter – all of the ones below work the same way with Bez Labelu. If you’re not sure, go with Google Authenticator – it is free, ad-free and the easiest to use. The links take you straight to the app’s page in the store, where you just tap Install.
If you already use an authenticator app (for example for Google, Facebook, Instagram or a work account), it will work for Bez Labelu too – you don’t need to install anything else.
Your banking app or your bank’s “SMS key” won’t help you here – they only confirm payments. You need a general authenticator app from the selection above. Likewise, don’t look for a Bez Labelu app – there isn’t one; the codes are generated by a third-party app.
Step 2 – Scan the QR code
After you log in, Artists Bez Labelu takes you to the setup page. In its second step there is a square black-and-white image – a QR code. You now scan it with the app from step 1:
-
Open the authenticator app on your phone
The first time you launch it, you may be greeted by a few intro screens – just tap through them. -
Tap to add an account
Usually this is a plus (+) button in the corner of the screen or an option such as Add a code, Add account or Scan a QR code. The app will ask for access to your camera – allow it. -
Point the camera at the QR code on your computer screen
You don’t take a photo or confirm anything – the app recognises the code by itself within a second and immediately adds a Bez Labelu entry with your email.
Then you have nothing to scan the QR code with – a phone can’t photograph its own screen. Use the key below the image: In the app, choose Enter a setup key (or Enter key manually), type Bez Labelu as the account name and type in or paste all 32 characters. Spaces don’t count, and the app doesn’t distinguish between upper and lower case. If the app asks for the type of key, leave it at Time-based.
It is the secret from which the codes are calculated. Whoever gets hold of it can generate your login codes themselves. Don’t send it to us either – we will never ask you for it. The key is saved to your account only after the code has been successfully verified in step 3; until you finish the setup, nothing changes.
Step 3 – Type in the six-digit code
As soon as the app adds the Bez Labelu entry, it shows a six-digit number next to it, along with a small circle or bar counting down 30 seconds to the next code. Type the number into the field in the third step on the setup page and tap Verify and enable.
No problem. A code is valid for 30 seconds, and for a short while after it expires we still accept the previous one too. If verification fails, simply type in the current number again. The space in the middle doesn’t matter – you can type it or leave it out.
The most common cause is an inaccurate clock on your phone. The codes are calculated from the exact time, so even a few minutes’ difference makes them invalid. In your phone’s settings, turn on automatic date and time from the network and try again. Google Authenticator also has a time synchronisation option in its settings – it fixes the problem without changing anything on your phone.
Step 4 – Save your backup codes
Right after you turn it on, eight backup codes are displayed. They are spare keys for when you lose, break or replace your phone and have nowhere to read the code from. Each backup code works only once and is entered in the same field as the code from the app.
Save them to a password manager, download, or print them.
We only store a fingerprint of them from which the codes cannot be read back – that is why we will not display them again, either to you or to ourselves. Tap Download as TXT or Print codes and keep them somewhere other than your phone: In a password manager, on your computer’s drive or printed out in a drawer. Don’t keep them only in the notes of the same phone that generates the codes – if you lose it, you lose both at once.
After you turn it on, we will send you a confirmation email. The same email also arrives every time verification is turned off or reset – if you receive such an email and you haven’t changed anything, write to us immediately and change your password.
What logging in looks like with verification turned on
You enter your email and password as always, and instead of the dashboard a page for the code is displayed. You open the app, type in the six-digit number next to the Bez Labelu entry, tap Verify – and you’re in. The whole thing takes a few seconds.
Tick it on your own computer or phone and we won’t ask you for a code for 30 days. It only applies to that browser – in a different browser, after clearing cookies, after changing your password or after setting up 2FA again, we will ask again. Never tick the box on someone else’s or a shared computer.
After the fifth wrong code, we log you out for security reasons. Nothing bad happens – log in again and type in a fresh code from the app.
The code you have just logged in with won’t work a second time. If you are asked for a code again straight away, wait until the next one appears on your phone.
When you can’t use the app
Under the heading Can’t use the app? on the code page, you have two fallback options. Both really are only fallbacks – the main route is still the app on your phone, which always works and works instantly.
One-time code by email
Tap Send a one-time code by email. You will receive a message with the subject “Jednorázový přihlašovací kód | Bez Labelu” (one-time login code) and a six-digit number, which you enter in the same field. The code is valid for 10 minutes. A maximum of 3 emails can be sent during a single login, and you have to wait at least a minute between them. The message may end up in spam, or a spam filter may delete it entirely – so don’t rely on email as your main route.
Backup code
Enter one of the eight backup codes from step 4 in the code field, for example A7K3P-Q2M9X. Once used, it is no longer valid. You can see how many you have left in your profile. You can type the hyphen or leave it out, and we don’t distinguish between upper and lower case.
No phone and no codes
Log in with a one-time code from your email and write to us. We will reset your verification and you will set it up again the next time you log in – this time on your new phone. Without access to your email you won’t be able to log in at all, so keep your inbox working.
New phone
Before you sell, wipe or hand in your old phone for repair, transfer the app to your new one. Google Authenticator and other apps can export all accounts via a QR code – look for Transfer accounts, Export or Back up in the app’s menu. The second option is a safeguard in advance: During setup, scan the same QR code with two phones at once (or enter the same key in both). Both will then show identical codes.
If you have replaced your phone without transferring the app, log in with a backup code or a code from your email. If 2FA is optional for you, turn it off in your profile and set it up again. If it is mandatory, write to us and ask for a reset.
What happens if you keep postponing the setup
If 2FA is mandatory for you, the setup page is displayed after every login. You can postpone it three times – you can see the number of postponements left right in the text of the Not now, I’ll set it up later link. On the fourth login, the page switches to its red version: Without setting it up, you can no longer get into the app.
Even here there is a last resort for when you don’t have your phone with you: The Send a one-time code by email button lets you in once, without the setup, after you enter the code from the email. The same rules apply as for logging in (10 minutes, a maximum of 3 emails, a minute between them). The page will be waiting for you again the next time you log in – it is not a way to avoid the setup permanently, and we keep a record of every such bypass.
Users for whom 2FA is optional can use the Not now, I’ll set it up later link without any limit and can turn verification on from their profile at any time.
After 10 wrong codes within an hour, verification for the account is temporarily blocked for security reasons – for up to an hour. Then try again with a fresh code from the app.
Managing verification in your profile
In your profile at artists.bezlabelu.cz/profile you can see whether you have two-factor authentication turned on and how many backup codes you have left. This is also where you turn it on if you postponed the setup. Until you have verification turned on, you will find Set up 2FA as the first item in the left-hand menu, and a notice with a setup button on your dashboard.
You can only turn it off if it is optional for you – and even then you need a valid code from the app, so that nobody who gets into your logged-in account without your phone can do it. Turning it off deletes the secret key and the backup codes and removes all trusted devices. When you turn it on again, you go through the whole setup again and receive a new set of backup codes.
Frequently asked questions
Not on your own device – tick Trust this device for 30 days. On someone else’s computer, yes, and that is how it should be.
Yes. The codes are calculated right on your phone from the key and the time; you don’t need a connection or a Czech SIM card.
Log in with a backup code or a code from your email. If verification is optional for you, turn it off in your profile and set it up again. If it is mandatory, write to us and ask for a reset – you cannot set it up again yourself.
Check your spam and bulk mail folders, wait a minute and send it again (no more than three times per login). If it doesn’t arrive at all, you probably have a problem with your inbox, and you need to fix it before you lose your phone.
You generate new ones by setting up verification again: If it is optional for you, turn it off and on again in your profile; if it is mandatory, we will reset it on request. Until then, you can log in with the app or a code from your email.
Change your password immediately and write to us. Someone probably knows your password.
No, it only complements it. Change a weak or reused password anyway – verification is a second lock, not a replacement for the first. What to do about a forgotten password is described in the article Can't log in or forgotten your password.