How we write and review our guides

Every guide on 2facounter.com is written and fact-checked by the 2FA COUNTER team. This page documents exactly what that means, so you can hold us to it — and so you know when a page was last checked and how to get it corrected.

Sources

Each per-service guide is fact-checked against the service's own documentation at the time of writing: the official security, sign-in, or settings pages for enabling two-factor authentication and revealing the setup key. We do not rephrase forum posts or third-party blogs. Where a service's flow changes between regions or account types (Google Workspace policies, Microsoft Entra ID, AWS's IAM console), the guide says so instead of papering over the difference. The date on each guide card — "fact-checked against …, last reviewed …" — tells you how fresh that check is.

What we deliberately do not claim

Screens change. Menu wording changes. Our guides describe the flow as checked on the review date and call out the parts most likely to differ. We don't embed screenshots that could go stale, and we never write a step we haven't walked through ourselves. For services whose code format isn't the TOTP standard this tool implements — most notably Steam's Steam Guard — the guide says plainly that a standards-based generator cannot serve as a replacement, rather than hinting otherwise.

Review cadence and corrections

• Every guide carries a last reviewed date. We re-check a guide when a service announces a security-settings change or when a reader reports that a flow has moved.
• Spotted something wrong or outdated? Mail guides@2facounter.com. We list what changed and update the review date once the correction is verified — major corrections get priority and typically ship within days.
• Security researchers: disclosures to security@2facounter.com are handled first-come, first-served, and every report gets a reply.

Editorial security protocol

The editors who test these flows follow the same rules we preach: accounts used in verification are dedicated test accounts whenever possible, secrets generated during testing are discarded and deleted, and no document, screenshot, or note containing a live setup key is ever stored. Verification happens with test keys or brand-new enrollments that are revoked straight after the check.

Language versions

The English pages on 2facounter.com are the source of truth. The other language versions are prepared with translation-assistance tooling and machine steps, then reviewed for structure, completeness, and technical accuracy before publication. A full native-speaker editorial pass is not yet complete for every language. Where a translation and the English text disagree, the English text governs. If a fluent reader spots a translation error, write to guides@2facounter.com and we will correct it in both languages.

Independence

2FA COUNTER is not affiliated with any of the services the site references, is not paid by any of them, and accepts no placement deals. Guides are driven by what people ask for, not by what anyone wants promoted. Where a service makes a questionable default the safer route — SMS-only 2FA, mandatory app installs — we say so in the guide rather than beside it.