Ask for a code before the document opens
A signing link is private, but email gets forwarded, inboxes get shared and laptops get left open. For a document with a Social Security number, a salary or a bank account on it, ask for a code before it opens. Then the link alone isn't enough to see what's inside.
Updated November 5, 2026 · 3 min read
On this page
Two kinds of code
| Code you share | Emailed code | |
|---|---|---|
| Who makes it | You type one, or press Generate | SignMaster, each time the signer asks |
| How the signer gets it | From you, by phone or text, not in the same email | By email, after they press Send me a code |
| Format | 4 to 10 letters or numbers; capitals, spaces and dashes don't matter | 6 digits that work once, for 10 minutes |
| What it proves | The person also has something you told them separately | The person can open that email inbox right now |
| Best for | Payroll, medical intake, anything where email alone feels thin | A quick check that the right person opened the link |
The shared code is the stronger of the two, because it travels by a different route than the link. The emailed code is easier for the signer, and it still stops anyone who has the link but not the inbox, like a colleague the email was forwarded to.
Add a code to an envelope
- 1
Open Message & settings
Each signer has a panel under Private notes & access codes.
- 2
Pick the code type
Under Require a code to open, choose Code you share or Emailed code for that signer. Others on the same envelope can have no code at all.
- 3
Copy a shared code now
Type a code or press Generate for a six-character one with no look-alike characters, so nobody confuses 0 with O. SignMaster shows it once and keeps only a scrambled copy, so press Copy code before you move on.
- 4
Tell the signer
Call or text them the code. Don't put it in the email message or the private note, or the code protects nothing.
Lost the code before telling them? Open Correct on the envelope, replace the code and send the correction. The signer gets a new link by email, and their old one stops working.
What the signer sees
The link opens a short screen instead of the document: Enter your access code, or for an emailed code, Confirm it's you with a Send me a code button. These screens appear in the signer's language. Once they're in, they stay in for 12 hours, so a signer who steps away doesn't have to start over.
- Five wrong tries lock the screen for 15 minutes.
- Emailed codes can be requested again after 30 seconds, up to five times an hour.
- Signer groups track codes per person, so one person's mistakes don't lock out the rest.
On the record
The envelope's activity shows when each person entered their code and which kind they used. Sent codes and successful checks are also in the event history on the certificate of completion, with the time and IP address of each.
Codes for templates and bulk sends
A template's Sending defaults can set each role's code type, so every envelope from it asks by default. In a bulk send, a role set to Code you share gets its own column in the blank CSV, and a header called code, access code, passcode or PIN is recognized too. A row without a valid code fails rather than going out unprotected.
Questions? Answers.
Can I see the code again after setting it?
No. SignMaster stores only a scrambled version. If you lose it, replace the code with Correct and share the new one.
Is an emailed code the same as two-factor authentication?
It's a second check on top of the link, but both arrive in the same inbox. For a check that doesn't rely on email at all, use a code you share by phone.
Does each signer need the same code?
No. Codes are set per signer, and each person can have a different type or none.
Is an access code the same as ID verification?
No. It shows the signer had the code; it doesn't check a government ID. To collect a photo of an ID, add an attachment field.