How to Set Up Multi-Factor Authentication (MFA) on GEDmatch
Multi-factor authentication adds an extra layer of security to your GEDmatch account. After entering your password, you’ll verify your identity through a second method — like approving a notification on your phone. This means that even if someone learns your password, they still can’t access your account.
Setting up MFA takes about 5 minutes. This guide walks you through our recommended method: the Auth0 Guardian app.
What You’ll Need
• Your GEDmatch login credentials
• A smartphone (iPhone or Android)
• Access to your phone’s app store
Step 1: Log In to GEDmatch
Log in at www.gedmatch.com with your email and password as usual. After logging in, you’ll see a prompt asking if you’d like to set up MFA.
Choose “Set up now” to continue.
If you’re not ready, you can select “Remind me next month” or “Remind me tomorrow”
Step 2: Download the Auth0 Guardian App
On the next screen, you’ll be asked to choose your MFA method. Select Auth0 Guardian.
Download the Guardian app on your phone:
• iPhone: Search “Auth0 Guardian” in the App Store
• Android: Search “Auth0 Guardian” in the Google Play Store
Step 3: Scan the QR Code
Once the Guardian app is installed, open it on your phone. In the app, tap the option to add a new account or scan a code.
On your computer screen, you’ll see a QR code. Point your phone’s camera at the QR code using the Guardian app.
If you can’t scan the QR code, you can also tap the option to enter the code manually — copy the code shown on screen and paste it into the Guardian app.
Step 4: Save Your Recovery Code
After linking the Guardian app, you’ll be shown a recovery code. This is important — if you ever lose access to your phone, this code is how you’ll get back into your account.
Write this code down and store it somewhere safe (not on your phone). You might keep it with other important documents or in a password manager.
Step 5: Test Your Setup
You may be asked to verify that everything is working. The Guardian app on your phone should receive a notification. Tap “Approve” to confirm.
That’s it — MFA is now active on your account.
Step 6: Set Up a Passkey (Optional but Recommended)
If you’d like to set this up:
• Choose “Set up passkey” when prompted
• Follow your device’s instructions to save the passkey
• Next time you log in, you can use your passkey instead of your password
Where your passkey is saved depends on your device:
• On iPhone: Saved to iCloud Keychain (uses Face ID or Touch ID)
• On Mac/PC: Saved to your browser or password manager (like 1Password)
View the article on passkeys for more details: https://support.gedmatch.com/portal/en/kb/articles/understanding-and-setting-up-passkeys-on-gedmatch
What Logging In Looks Like After Setup
With MFA (no passkey): Enter email → Enter password → Approve Guardian notification → Logged in
This is what the Guardian notification looks like and how you approve the login:
With passkey: Enter email → Use fingerprint/Face ID/password manager → Logged in
Managing Your MFA Settings
You can manage your MFA setup at any time from your profile.
• Log in to GEDmatch
• Navigate to your Profile settings
• Find the MFA / Security section
From here you can:
Remove your current MFA method: If you want to switch to a different method or start over, you can delete your current MFA setup. This will also remove your recovery code. The next time you log in, you’ll be prompted to set up MFA again and will receive a new recovery code.
Set up a new MFA method: After removing all MFA methods, you can set up a new one directly from this screen without waiting for the next login prompt.
Frequently Asked Questions
What if I lose my phone?
Use the recovery code you saved during setup. On the login screen, look for the option to use a recovery code instead of the Guardian notification.
Can I switch to a different MFA method later?
Yes. Go to your Profile settings and remove your current MFA method. You can then set up a new method right from the same screen, or you’ll be prompted to choose a new method at your next login. Note that removing MFA does not remove your recovery code — you’ll need to remove the recovery code so that you get a new one when you set up your new method.
Do I have to use MFA?
Not right now. You can choose “Remind me in 30 days” to delay. However, we strongly recommend it to protect your account and your genetic data.
What’s the difference between MFA and a passkey?
MFA adds a second step after your password (like a phone notification). A passkey replaces your password entirely with something like a fingerprint. You need to set up MFA first before you can create a passkey.
I don’t have a smartphone. What are my options?
You can use a hardware security key (a small USB device) as your MFA method. Contact support for guidance on compatible security keys.
What if I get a Guardian notification I didn’t expect?
Tap “Deny” in the Guardian app immediately. This means someone is trying to log into your account with your password. We recommend changing your password right away.
Need Help?
If you run into any issues during setup, contact our support team by submitting a ticket through this portal. We’re happy to walk you through it.
Related Articles
Setting Up MFA with Google Authenticator on GEDmatch
Google Authenticator is a free app that generates one-time security codes on your phone. When you log in to GEDmatch, you’ll enter your password and then type a 6-digit code from the app. The code changes every 30 seconds, so it can’t be reused by ...Using a Password Manager for MFA on GEDmatch
If you don’t have a smartphone, or prefer to keep everything on your computer, you can use a password manager to handle multi-factor authentication (MFA) on GEDmatch. Many password managers include a built-in authenticator that generates the same ...Understanding and Setting Up Passkeys on GEDmatch
Passkeys are a newer, simpler way to log in to your GEDmatch account. Instead of typing a password and then approving an MFA notification, you can log in with just your fingerprint, Face ID, or a password manager. It’s faster, easier, and more secure ...Troubleshooting Common GEDmatch Errors
Site Access Errors 403 Error / "Bot Detection" Block Symptom: You receive a 403 error or a message indicating you have been identified as a bot and cannot access the site. Cause: GEDmatch has security measures in place to prevent automated access. ...How to Use GEDmatch DNA Matching Tools (One-to-Many, One-to-One, Segment Search)
Before You Begin To use GEDmatch's matching tools, you need: 1. A GEDmatch account with at least one uploaded DNA kit. 2. Your kit must have finished processing (typically 24–48 hours after upload). If your kit is still processing, matching tools ...