Sign in and turn on two-step verification
Every way into Polzy — password, sign-in link, Google, Microsoft or your organization's single sign-on — and how to protect your account with an authenticator app, recovery codes and your list of signed-in browsers.
On this page
This page is for everyone who signs in to Polzy: Admins, Editors and Viewers. It covers each way in, what to do when a password or a link does not work, and how to add a second step that keeps your account safe even if somebody learns your password.
People answering a survey never need an account: the link in their invitation is enough.
Before you start
- The email address your organization invited you with, or the one you signed up with.
- For two-step verification: a phone with an authenticator app — Google Authenticator, Microsoft Authenticator, 1Password or any other app that shows six-digit codes.
- Somewhere safe to keep ten recovery codes: a password manager, or a printed page.
Ways to sign in
Open app.polzy.ai/login, or follow any Polzy link while signed out. The page is Sign in to Polzy.
- Email and password. Type your Email and Password and click Sign in. The eye in the field shows the password as you type.
- Email me a sign-in link. Type your email and click it instead of typing a password. The email holds a link and a six-digit code; either one works once, for 15 minutes. On the Check your email page you can open Gmail or Outlook, type the code, or choose Send a new link once the countdown ends.
- Google or Microsoft. The buttons at the top sign you in with that account, when its address is the one Polzy knows. Your address is already confirmed by them.
- Your organization's single sign-on. Polzy recognizes your work address and offers your organization's own button — see the next section.
Keep me signed in for 30 days is ticked to begin with. Ticked, you stay signed in on this browser for 30 days; not ticked, for 12 hours. If your organization set a Session length under Organization settings → Security, that length applies instead.
Several workspaces? Each browser tab can be in a different workspace, each with its own sign-in. Switch with the workspace menu at the top of the sidebar.
Sign in with your organization's single sign-on
When your organization has set up single sign-on for its email domain, Polzy finds it from your address.
- Type your work email on the sign-in page.
- After a moment, a Continue with button with your organization's name replaces Google and Microsoft.
- Click it. Your identity provider — Okta, Microsoft Entra ID, Google Workspace or another — asks you to sign in, then sends you back to Polzy.
If your organization requires single sign-on, the password field gives way to Your organization requires single sign-on., and no sign-in link is offered. Sign in with a password instead is for the few your organization still lets in with a password when its identity provider is down — its Owner, and the admins it names. They also need two-step verification turned on.
In your organization's own workspaces, a sign-in through its single sign-on counts as the second step: Polzy does not ask for your authenticator code there. Set up single sign-on is the article for the Owner and the IT team.
Forgot your password
- On the sign-in page, click Forgot password?
- Type your Email and click Send reset link. A check that you are human may appear first.
- Open the email. The link works once, for one hour.
- On Choose a new password, type a New password of at least 10 characters, then Confirm password.
- Click Update password. You see Password updated and go back to sign-in.
Resetting your password signs you out of every browser. To change a password you know, use My profile → Signing in → Change password instead; that signs out every browser but the one you are using.
Signed up with Google or Microsoft? Then you have no Polzy password, and Forgot password? sends nothing. Keep using Google or Microsoft, or Email me a sign-in link. While your organization requires single sign-on, no reset link is sent either.
Turn on two-step verification
Two-step verification asks for a six-digit code from your phone after your password, your sign-in link or your Google or Microsoft sign-in. The code changes every 30 seconds, so a stolen password is not enough to get in.
- Click your name at the bottom of the sidebar and choose My profile.
- Under Signing in, find Two-step verification and click Turn on. A panel opens with three steps: Scan, Verify and Save codes.
- Scan. Open your authenticator app, add an account (often a + button), and scan the QR code. Can't scan it? Click Can't scan it? Enter a setup key and type or paste the key instead — it is time-based, six digits, 30 seconds. Click Next.
- Verify. Type the six-digit code the app now shows for Polzy. A ring shows when the next code arrives.
- Save codes. Download, copy or print the ten recovery codes, tick I've stored these codes somewhere safe, and click Turn on.
- You see Two-step verification is on, with the method, how many recovery codes are left and the date. Click Done.
We email you when two-step verification is turned on. If that was not you, change your password at once.
How to add an account to your app, in its maker's words: Microsoft: Add your accounts to Microsoft Authenticator (choose Other account), Google: Get verification codes with Google Authenticator, and 1Password: Use 1Password as an authenticator.
Sign in with a code
With two-step verification on, signing in has a second screen, Enter your code.
- Open your authenticator app and type the six-digit code it shows for Polzy. It is checked as soon as the sixth digit is in.
- Leave Trust this device for 30 days ticked on a browser that is yours: this browser then skips the code for 30 days. Untick it on a shared computer.
- No phone at hand? Click Use a recovery code and type one of your saved codes — ten letters and digits, like
abcde-12345. Each works once, and the screen says how many you have left.
The browser stops being trusted when the 30 days run out, when you choose Sign out everywhere, or when you turn two-step verification off.
Recovery codes
Recovery codes are your way in when your phone is lost, broken or replaced. You get ten when you turn two-step verification on.
- Shown once. Polzy shows the codes only when they are made. Keep them in a password manager or on paper, away from your phone.
- N of 10 left. Under My profile → Signing in → Recovery codes you see how many are left.
- New codes. Makes ten new codes and stops the old ones working. You confirm with your password or a current code from the app.
Where you're signed in
My profile ends with Where you're signed in: every browser signed in to your account, in every workspace you belong to.
- Each row names the browser and system — "Chrome on macOS" — the workspace, when it was last active and, where known, the network it came from. This browser marks the one you are using.
- Sign out on a row signs that browser out. Whoever is using it has to sign in again.
- Sign out everywhere signs out every browser, this one included.
- Opened as admin marks a session a Polzy staff member opened to help with your workspace.
A browser you do not recognise? Sign it out, then change your password and turn on two-step verification.
When your organization requires it
The organization can require two-step verification for its Admins under Organization settings → Security → Require two-step verification for admins. Then:
- An Admin without it sees Set up two-step verification at their next sign-in, and cannot reach anything else until it is done. Sign out is the only other way out.
- An Admin who has it cannot turn it off: the row says Your organization requires it for your role.
- Signing in through the organization's single sign-on counts as the second step, so it is not asked for there.
Your organization's security settings explains the rule and the other sign-in settings.
Turn it off
- Go to My profile → Signing in → Two-step verification and click Turn off.
- Confirm with your password or a current code from the app.
Your recovery codes stop working, and trusted browsers are forgotten. Turn off is not offered when your organization requires two-step verification.
Troubleshooting
That code is not right. Check the time on your phone and try the newest code. — Codes depend on the clock. Polzy accepts the current code and the one either side of it, so a phone more than about 30 seconds out is refused. Set your phone's date and time to automatic — Android: Set time, date and time zone, Apple: If you can't change the time on your device — then try the newest code.
Too many wrong codes. Try again in N minutes. — Wait the minutes it says, then use the newest code or a recovery code.
This sign-in expired. Please sign in again. — The code screen waits five minutes. Start again from the sign-in page.
I lost my phone, or got a new one. — Sign in with a recovery code, then go to My profile → Signing in: click Turn off and Turn on again with the new phone, or New codes if you only need fresh codes. Lost both phone and codes? Nobody in your organization can turn it off for you; write to Polzy support from the address you sign in with, through the contact page.
That email and password do not match. Try again, or reset your password. — Check the address, and whether caps lock is on. Use Forgot password? if you are not sure.
Too many failed sign-in attempts. Try again in N minutes, or reset your password. — After eight wrong passwords in 15 minutes, signing in with a password pauses for 15 minutes. Wait, or reset your password.
This sign-in link or code is invalid or has expired. — A sign-in link works once, for 15 minutes; a newer link replaces an older one. Ask for a new one.
This reset link has expired or was already used. Ask for a new one. — Reset links work once, for one hour. Click Request a new link.
Confirm your email address to sign in. We can send the link again. — Your address was never confirmed. Click Send the link again and open the newest email.
You have not been added to your organization's workspace yet. Ask your administrator to invite you. — Your organization's single sign-on works, but you are not a member. Ask an Admin or the Owner.
This account has been deactivated. Contact your administrator. — Your membership was removed or deactivated, by an Admin or by your directory.
Good to know
- Your sign-in details are shared across workspaces. One password and one two-step setup cover every workspace you belong to.
- Changing your password signs out your other browsers; resetting it signs out all of them.
- Your email address is changed by an Admin, not on your profile.
Related articles
Signed-in members can ask Polzy or message the team from Support. How fast we reply depends on your plan.