Security

Protect your Hoppla account with additional security features. All security settings are managed from Settings > Security in the dashboard.

Password Requirements

Hoppla enforces a strong password policy when you sign up and whenever you change your password:

• Passwords must be at least 12 characters long.
• Passwords are checked against databases of known-breached passwords. If your chosen password has appeared in a public data breach, it is rejected and you will be asked to pick a different one.

We recommend using a password manager to generate and store a unique, random password for Hoppla.

Two-Factor Authentication (2FA)

Add a second layer of protection to your account with time-based one-time passwords (TOTP).

Setup

1. Go to Settings > Security.
2. Click Enable Two-Factor Authentication.
3. Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, Bitwarden, or any TOTP-compatible app).
4. Enter the 6-digit code from your app to confirm.
5. Save the recovery codes in a secure location.

Recovery Codes

When you enable 2FA, you receive a set of one-time recovery codes. Each code can be used once to log in if you lose access to your authenticator app. Store these codes securely (e.g., in a password manager).

If you run out of recovery codes, you can regenerate them from the Security settings page.

Remember This Device

When you log in with 2FA, you can choose to remember this device. On a trusted device, Hoppla then skips the 2FA prompt on future logins for a while. This is per-device -- remembering your laptop does not affect your phone, and you can require 2FA again at any time by signing out of that device.

Organisation-Wide 2FA Enforcement

Team admins can require every team member to have 2FA enabled. When enforcement is turned on:

• Members who do not yet have 2FA are guided through enrollment the next time they log in, directly in the app.
• The admin who turns it on is never locked out of their own account.

This is a great way to raise the security baseline for your whole team. You'll find the toggle under Settings > Security (admin only).

Active Sessions

The Security page lists the devices and browsers currently signed in to your account, so you can spot anything unfamiliar. If you no longer recognise a session -- or you've logged in on a shared computer -- you can sign out that session remotely. Signing out other sessions does not affect the one you're currently using.

Passkeys

Passkeys provide passwordless authentication using WebAuthn. They work with hardware security keys (YubiKey), platform authenticators (Touch ID, Face ID, Windows Hello), and password managers that support passkeys.

Adding a Passkey

1. Go to Settings > Security.
2. Click Add Passkey.
3. Follow your browser's prompt to register the passkey.
4. Give the passkey a name (e.g., "MacBook Touch ID", "YubiKey 5").

You can register multiple passkeys for redundancy.

Single Sign-On (SSO)

Available for teams with SSO-enabled plans. Hoppla supports OpenID Connect (OIDC) providers, including:

• Azure Active Directory / Entra ID
• Google Workspace
• Okta
• Any OIDC-compliant identity provider

SSO is configured at the team level by an admin. Once enabled, team members authenticate through your identity provider instead of using a Hoppla password.