How do I turn on two-factor authentication in Willowfolio?
Go to Settings, then Security. From there you can turn on two-factor authentication (2FA, a second sign-in step where you type a code from an authenticator app) and connect Google as a backup way to sign in.
The whole thing takes about five minutes. The most important part is saving the recovery codes. Everything else you can undo later.
Why would I want two-factor authentication on a home education app?
Your child's records, observations, Council Reports (the LA-ready document Willowfolio generates for you) and photos are all in one place. In a home education app, that is a lot of sensitive information under one login. If someone guessed your password, they could see all of it. Two-factor authentication means a password alone is not enough; a person also needs the six-digit code from your authenticator app.
This is not about being paranoid. It is about the same quiet care you bring to the rest of your home education. If you lock the front door before bed, this is the digital version.
From now on, every time you sign in with your email and password you will also enter a six-digit code from your authenticator app. If you sign in with Google, the two-factor step is handled by Google's own security.
What if I lose access to my authenticator app?
This is what the recovery codes are for. At the sign-in screen, choose the option to use a recovery code instead of the six-digit code. Type one of your eight codes. It will work once, and then that code is spent.
If you have used all eight codes, or you never saved them, email [email protected]. A real person will verify your identity and help you regain access. It may take a little longer than usual, because we check manually to keep your records safe.
The best insurance against this is saving the recovery codes somewhere you will not lose them. A notes app on a different device, a password manager, or a printed slip in a drawer all work. What matters is that it is not only on the phone that holds your authenticator.
What about the password-reset link?
If you forget your password, the Forgot password link on the sign-in screen works on every account, whether you signed up with email or with Google. When you click the reset link in your email, you see a short "Continue to set new password" confirmation screen before the form appears. The one-use link from your email is removed from the browser's address bar as soon as the page loads, and the link stops working once you set the new password, so the email is safer to leave in your inbox.
Why did Google sign-in create a second account instead of signing me in?
If you signed up with an email and password, and you later click "Sign in with Google" from a logged-out browser using the same email address, you may end up with a second, separate account instead of signing in to your existing one.
The workaround is straightforward: sign in with your password first, then connect Google from Settings, then Security. Once connected, Google sign-in and your email-and-password sign-in both point to the same account.
If you have already ended up with two accounts, email [email protected] and we will merge them. Nothing is lost; it just needs a manual tidy from our end.
What does this look like in practice?
Aisha lives in Bradford and home educates her two girls, aged five and eight. She works rotating shifts as an NHS porter, so she often logs observations and activities late in the evening or early in the morning, whenever the house is quiet.
When the Security panel appeared in Willowfolio, she turned on two-factor authentication during a night shift break. She scanned the QR code with Google Authenticator on her phone, typed the six-digit code, and saved the eight recovery codes by screenshotting them to her photos folder. She also connected Google sign-in as a backup, because she knew she would eventually forget her password at 6am after a long shift.
A few weeks later, her phone died mid-day. She borrowed her mum's tablet, went to the Willowfolio sign-in page, and used one of her recovery codes to get in. Her records, her girls' observations, the Council Report draft she had been working on for Kirklees, all still there. She set up Google Authenticator on the replacement phone that evening.