Skip to main content
To help keep your account safe, Box may ask you to confirm your identity with a one-time passcode (OTP) when you log in. This is an extra step, in addition to your email and password, that helps prevent someone else from accessing your account if your current session cannot be verified. You won’t be asked for a passcode every time you log in. Box only prompts you in specific situations where a sign-in looks suspicious. This passcode is for that single login only.

​
When Box asks for a one-time passcode

Box prompts you for a one-time passcode at login if you sign in from a new device or in a new location, or both. If you already have multi-factor authentication, SSO, or Google sign-in enabled, you will not be required to go through the one-time passcode process.

​
Logging in with a one-time passcode

To verify your identity with a one-time passcode:
  1. Go to the Box login page: app.box.com/login.
  2. Enter your email and password as you normally would. If verification is required, Box redirects you to the one-time passcode screen.
  3. Retrieve your one-time passcode, sent to you by email.
  4. Enter the passcode and click Submit.
Once your passcode is accepted, Box logs you in to your account as usual.
Your one-time passcode is valid for ten minutes. Beyond this time, you need to generate a new one-time passcode.

​
Troubleshooting

​
I didn’t receive my passcode

Begin the steps again that are outlined in Logging in with a one-time passcode. If the passcode still doesn’t arrive:
  • Make sure you’re checking the correct inbox.
  • If the email address is correct, check if your email provider isn’t blocking messages from Box.
  • Check your spam folder.
  • Wait a few minutes, as the messages can sometimes be delayed.

​
My passcode isn’t working or has expired

Passcodes are valid only for a limited time. Request a new passcode and enter the most recent one you receive.

​
I can’t access where the passcode is sent

If the code is going to an email address you can no longer access, you cannot finish verifying. If you have an active session on another device, sign in there and add an email address you can access in account settings. If you can’t retrieve the code and don’t have another signed-in device available, reach out to your email provider to ask for account recovery options for that email address. If the email address is permanently unreachable, set up a new Box account using a different username and email address.

​
How do I turn this setting on or off?

For security reasons, this functionality cannot be turned off.
Last modified on July 24, 2026