Account Security

Multi-factor authentication, password best practices, and how to recover access to your 5-by-5 account.

Overview

5-by-5 stores your aircraft records, flight logs, member contact details, and financial ledger and bank-balance information. Protecting that account is worth a few minutes of setup. This page covers the security features available today and the steps to get the most out of them.

Multi-Factor Authentication (MFA)

Multi-factor authentication adds a second step to sign-in: in addition to your password, you also enter a 6-digit code from an authenticator app on your phone. Even if someone steals your password, they can’t sign in without the device that generates the codes.

5-by-5 supports time-based one-time passwords (TOTP) — the same standard used by Google, AWS, GitHub, and most banks.

Where MFA Appears

It’s one factor on one account, so you enroll once and it covers every device you sign in on. There are five places you’ll meet it:

You won’t be asked for a code every time you open the app. Once you’ve verified, the session stays trusted on that device until you sign out or it expires — the prompt is tied to signing in, not to launching the app.

Supported Authenticator Apps

Any TOTP-compatible app works. Popular choices:

• Google Authenticator (iOS, Android) — free, no cloud backup
• Microsoft Authenticator (iOS, Android) — free, cloud backup via Microsoft account
• Authy (iOS, Android, desktop) — free, encrypted cloud backup, multi-device
• 1Password, Bitwarden, Apple Passwords — built-in TOTP if you use these password managers

We recommend an app with cloud backup (Microsoft Authenticator, Authy, or a password manager) so you don’t lose access if you switch phones.

Setting Up MFA

MFA is strongly recommended, and your group may require it. If you create your account on the web, signup takes you straight into setting up your group, and the Overview page of the web dashboard suggests two-factor afterward (choose Later and it comes back in a week). In the mobile app, an enrollment screen appears the first time you sign in, with a Not now that brings it back in a couple of weeks. Either way you can start it any time from Settings. If an owner or admin of one of your groups has switched on Require two-factor authentication, there is no Not now and you cannot proceed without completing it.

The screen shows a setup key prominently with a smaller QR code below.

Because you’re usually setting this up on the same phone running 5-by-5 (which can’t scan its own screen), the primary path is to copy the setup key and paste it into your authenticator. The QR code is for the case where your authenticator lives on a different device.

Primary path: setup key copy/paste

1. On the MFA enrollment screen, tap Copy setup key — 5-by-5 copies a string of letters and numbers to your clipboard
2. Open your authenticator app, tap to add a new account, choose Enter setup key (wording varies — sometimes “Manual entry” or “Setup key”), and paste
3. Your authenticator now shows a 6-digit code for “5-by-5” that refreshes every 30 seconds
4. Type that code back into 5-by-5 to confirm setup

Secondary path: QR code (when your authenticator is on a different device)

If your authenticator runs on a separate device — an iPad while 5-by-5 is on your iPhone, a desktop password manager, etc. — scroll down on the enrollment screen to the smaller QR code and scan it from that other device instead. Then type the resulting 6-digit code back into 5-by-5 to confirm setup.

Once enrolled, every future sign-in on any device requires the 6-digit code in addition to your password. The Settings → Authentication row shows your enrollment status — a green On indicator under normal operation — along with how many recovery codes you have left.

Recovery Codes

The moment you finish enrolling, 5-by-5 generates three recovery codes and shows them to you once. Each one looks like 4TKQ9-RB2MX, works a single time, and will get you back into your account when your authenticator is not available.

Three rather than ten because, in practice, you will only ever use one. Redeeming a code clears two-factor off your account and hands you a fresh set when you set it up again — so unlike services where each code buys a single sign-in, there is nothing to ration here. Save all three together; the spares are there in case one gets garbled on its way to wherever you keep it.

Keep them somewhere you can reach without the phone running 5-by-5 — a password manager that syncs to your other devices, or printed and filed with your aircraft paperwork. Saved only on the phone you lost, they defeat the purpose.

Generating a New Set

Either app will do it, and both show how many unused codes you have left:

• Mobile: Settings → Authentication → Two-Factor Authentication
• Web: Settings → My Profile → Authentication card → Generate Recovery Codes

Generating replaces every existing code at once — anything you wrote down previously stops working immediately. Do it when you are down to one or two, when you think a copy has been exposed, or when you never saved the original set.

Signing In with MFA Enabled

1. Enter your email and password as usual
2. The app prompts you for a 6-digit code
3. Open your authenticator app and read the current code for “5-by-5”
4. Enter it into the 5-by-5 prompt
5. You’re in

Codes refresh every 30 seconds. If yours has only a few seconds left, wait for the next one — codes that just rolled over are sometimes still accepted, but it’s safest to use a fresh code.

Requiring MFA for a group

Owners and admins see a Member Security card in the web dashboard under Settings → Members, with one switch: Require two-factor authentication for every member. It is off by default.

Switched on, any member of that group who has not set up an authenticator is asked to do so before they can use 5-by-5, with no way to skip. Switched off, we still recommend it and prompt occasionally, but nobody is blocked.

Two things worth knowing before you flip it:

• It applies to people, not groups. A member who belongs to several groups is required if any one of them requires it. A club that does not require MFA cannot relax one that does.
• Turning it off never removes anybody’s two-factor. Members who already have it keep it and keep being asked for their code at sign-in. The switch governs who must enroll, not who must verify.

MFA can’t be disabled in-app

Once enrolled, MFA stays enrolled — there’s no in-app path to turn it off, and that holds whether or not your group requires it. Tapping the Two-Factor Authentication row in Settings shows your status and your recovery-code count, not a disable option.

This is intentional. A second factor you hold is a second factor you get asked for; one that could be switched off from inside an already-signed-in session would protect nothing. If you need to move it to a new phone, redeem a recovery code — that clears it and walks you through setting up the new device.

Lost access to your authenticator? That is a different problem with a self-service answer — see What if I Lose My Authenticator? below.

What if I Lose My Authenticator?

If you have a recovery code, you can fix this yourself in about a minute.

1. Sign in with your email and password as usual
2. At the 6-digit code prompt, choose Lost your authenticator? Use a recovery code — it is on both the mobile prompt and the web dashboard one
3. Enter one of your codes — dashes and lower case are fine, the app tidies it up
4. Two-factor comes off your account and you land on the enrollment screen
5. Set up your new phone’s authenticator, and you are handed a fresh set of codes

A used code is spent for good, but because enrollment issues a brand-new set, you come out of this with a full three again rather than two.

If you have no recovery codes either

Contact support@fly5by5.com from the email address on your 5-by-5 account. We will verify your identity — typically a reply from the original address plus another channel such as a phone call — and then clear the factor manually. You will sign in with your password alone and be prompted to enroll a new authenticator.

Password Best Practices

5-by-5 requires passwords to be at least 8 characters with both letters and numbers, and screens new passwords against known-breached password databases via Supabase’s leaked-password protection. Beyond the minimum, you control how strong your password is.

Recommendations:

• Go longer than the minimum — 12+ characters is meaningfully stronger, and a multi-word passphrase is easy to remember
• Unique to 5-by-5 — don’t reuse a password you use anywhere else
• Generated by a password manager — humans are bad at creating random-looking strings; 1Password, Bitwarden, Apple Passwords, or Chrome/Safari built-in are all good options
• Don’t memorize it — that’s what the password manager is for

If your password ever appears in a public breach database, Supabase will reject it at next sign-in and require you to reset.

Changing Your Password

Available on both mobile and web:

• Mobile app: Settings → Authentication → Change Password
• Web dashboard: Settings → My Profile → Authentication card → Change Password

Enter the new password twice and submit. You’ll stay signed in on the current device. Other signed-in devices stay signed in too (no remote sign-out), so revoke any sessions you don’t recognize via your password manager’s session list if it supports that.

Forgot Password

On the sign-in screen, tap Forgot Password. Enter your email address. You’ll receive a one-time reset link from noreply@fly5by5.com valid for 1 hour. Click the link and set a new password.

If the email doesn’t arrive within a few minutes, check your spam folder and follow the steps in Email Notifications so future system emails don’t get filtered.

Account Email

The email address on your account serves two purposes:

1. Your sign-in identifier
2. The destination for all account emails (invitations, invoices, receipts, password resets, etc.)

If you change jobs or providers, update your email promptly:

• Mobile app: Settings → Authentication → Change Email
• Web dashboard: Settings → My Profile → Authentication card → Send Change-Email Confirmation

A confirmation link goes to both the old and new addresses; you must click the link in the new address to complete the change. Until that link is clicked, the old email is still your active sign-in identifier.

Signing Out

This device — Settings > Sign Out. Removes credentials from this specific device only.

All devices — currently requires a password change (which invalidates other active sessions) plus signing out manually anywhere you suspect a stale session. A “sign out everywhere” button is on the roadmap.

Deleting Your Account

Deleting your account removes your personal information from every group you belong to and closes your login for good. It does not erase the group’s flight or financial history — those records stay intact so the logbook and the books stay complete; only your personal details come off them.

For every group you’re a member of:

• Your contact info, medical, certificates/ratings, currency dates, title, and photo are removed
• You’re unlinked from the group — you no longer appear in member lists and you lose access
• Your flights, ledger entries, and invoices stay exactly as they were, still attributed to your name — this is deliberate, so the group’s flight log and financial records remain accurate for everyone else
• Any pending bookings you had are canceled

If you belong to more than one group, all of them are handled in a single pass — you don’t need to leave each one individually first.

If you are an Owner with other active members in any of your groups, deletion is blocked in that group until you transfer ownership — the app tells you which group needs it. If you’re the only member of a group, that entire group (aircraft, maintenance history, ledger, everything) is deleted along with your account, since nothing would be left to preserve.

Two things ARE fully deleted rather than retained: your personal flight-currency tracking (day/night/IFR/flight-review/IPC dates) and any squawks you personally reported — neither has a reason to stay once you’re gone.

To delete: Settings > Delete Account, then confirm.

Reporting Security Issues

Found a vulnerability? Email support@fly5by5.com with the details and we’ll respond within 1 business day. We don’t yet have a formal bug bounty program, but we deeply appreciate responsible disclosure — please give us a reasonable window to fix before publishing.