Skip to Content
Australia (AU)AccountPassword & MFA

Password & Multi-Factor Authentication (MFA)

Your Rebased sign-in is protected by two things: a password and multi-factor authentication (MFA). MFA is mandatory — you cannot use the app without it — because a single stolen password is not enough to take over an account that holds your accounting records, payroll, and bank data.

This page covers everything you can do from the sign-in screen and from your Personal profile:

Change your password

If you know your current password and are signed in:

  1. Sign in as usual (including MFA).
  2. Open Personal profile from the sidebar user card.
  3. Under Security, choose Change password and follow the prompts.

Reset your password

If you cannot sign in because you do not know your password:

  1. On the sign-in screen, choose Forgot password?.
  2. Enter your Rebased email and choose Send reset link.
  3. Check your inbox. Rebased sends an email from our notifications sender with a Reset password link.
  4. Click the link. You will land on a page where you can set a new password. If the link has expired or you opened it in a different browser session, request a new one.
  5. After you save the new password, Rebased signs you out and sends you back to the sign-in screen. Sign in normally — you will still be asked for your MFA code.

Notes:

  • The reset link is single-use and expires after a short period. Request a new one if it stops working.
  • Resetting your password does not reset MFA — you still need your authenticator (or a recovery code).
  • If the email does not arrive, check your spam folder and that you are using the exact email on your account. For privacy Rebased shows the same “email sent” message whether or not the address is on file.

Set up MFA

MFA is required for every user. The first time you sign in (or after your MFA has been reset), Rebased takes you to the MFA setup screen:

  1. Install an authenticator app on your phone if you don’t have one. Good choices: 1Password, Authy, Google Authenticator, Microsoft Authenticator.
  2. Scan the QR code Rebased shows you, or paste the secret key into the app manually.
  3. Enter the 6-digit code your authenticator generates to prove it is working.
  4. Rebased shows you a list of recovery codes. Save these somewhere safe — a password manager is ideal. Each code can be used once if you ever lose access to your authenticator app.

From then on, every sign-in asks for a fresh 6-digit code from your authenticator.

Regenerate recovery codes

If you have used some of your codes, or think they may have been seen by someone else:

  1. Go to Personal profile → Security.
  2. Choose Regenerate recovery codes.
  3. Enter a current 6-digit code from your authenticator to confirm it’s really you.
  4. Save the new codes. Old codes immediately stop working.

Reset MFA — admin path

Use this when a team member has lost their phone or reinstalled their authenticator app and cannot sign in, but at least one other owner or admin of the same business is still able to sign in.

Who can do this? Any owner or admin of the business, resetting MFA for any other active member (not themselves, and not the business owner).

  1. The admin signs in and goes to Settings → Team.
  2. Select the affected team member to open their detail page.
  3. Choose Reset MFA and confirm.
  4. Rebased deletes the user’s TOTP factor and invalidates any unused recovery codes. The next time that user signs in they are taken to the MFA setup screen and can enrol a fresh authenticator app.

Guardrails:

  • An admin cannot reset their own MFA from this screen — use the self-service path instead.
  • The business owner’s MFA cannot be reset this way. If the owner has lost access, they must use the self-service path.
  • The team member’s password is unchanged. They still need to know their password to sign in.

Reset MFA — self-service (24-hour) path

Use this when there is nobody else who can reset your MFA for you — for example, you are the sole owner of your business and you have lost both your phone and all your recovery codes.

Because this path is the last line of defence against an attacker who has only your password, Rebased enforces a deliberate 24-hour cooling-off period before it takes effect. While the timer runs, the legitimate account holder has a chance to log in from any remembered device and cancel the reset.

Starting a reset

  1. On the sign-in screen, enter your email and password as usual.
  2. When Rebased asks for your MFA code, choose Lost your device and recovery codes?.
  3. Enter the email on your Rebased account and choose Send reset link.
  4. You will see a confirmation message. For privacy, Rebased shows the same message whether or not the email is on file.
  5. If the email is on file, Rebased sends you an email with two links:
    • Confirm reset — only works 24 hours after the request.
    • Cancel request — works immediately.

What happens in the next 24 hours

  • You can sign in normally with your password and MFA at any time during the window — the pending reset does not block sign-in.
  • Every time you open the dashboard, a banner appears warning that an MFA reset has been requested for your account, with a This wasn’t me — cancel reset button. Click it immediately if you did not start this reset. This is what makes the 24-hour window safe: a stolen password is not enough to silently disable your MFA.
  • You can also use the Cancel request link in the email.

Confirming the reset after 24 hours

  1. After at least 24 hours have elapsed, click the Confirm reset link in the email (or open /mfa-reset?token=…).
  2. Rebased verifies the request is still valid, deletes your TOTP factor and recovery codes, and clears the MFA flag on your account.
  3. Sign in with your password — you will be taken to the MFA setup screen and can enrol a fresh authenticator.

Notes:

  • A reset can be cancelled at any time up until it is confirmed. Once it is confirmed or cancelled, the link cannot be reused.
  • If the 24 hours have elapsed but you never click Confirm, nothing happens — your MFA stays in place. Request a new reset if you still need it.
  • The confirmation email is the only way to complete a self-service reset. If the email does not arrive, check spam and that the email on file is correct.
  • If you have lost access to your email as well as your phone, contact support.
Last updated on
Setting Up Your FirmOverview