How does two-factor authentication work?

Whenever a client logs in from a new device, they will not only be asked for a password but also for a 6 digit code which is sent to their email (or as text message) and valid for 20 minutes only.

If a client regularly uses a known device which is secure, they can check the Remember this device checkbox. Future login attempts from this device will then not require two-factor authentication.