Two-factor authentication

Two-factor authentication adds a second step when you sign in with your email and password. As well as your password, you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still can’t get in without your phone.

You’ll need an authenticator app, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy.

Turn on two-factor authentication

1. Open the account menu (your initial, top right) and choose Security.
2. Under Two-factor authentication, choose Turn on.
3. Scan the QR code with your authenticator app. If you can’t scan it, type the key shown under Can’t scan it? Enter this key instead: into the app.
4. Enter the 6-digit code the app shows in Two-factor code, and choose Confirm and turn on.
5. You’ll see Your recovery codes. Save them now (see below), then choose I’ve saved them.

The status now says On.

Keep your recovery codes safe

You get 10 recovery codes. Each one works once, in place of an app code, if you lose your phone.

• Choose Copy codes and paste them into a password manager, or write them down and keep them somewhere safe.
• You only see them once. After you choose I’ve saved them, they’re hidden for good.
• The Security page shows how many you have left.

If you lose your phone and your recovery codes, you can’t sign in with your password. Save the codes before you leave the page.

Sign in with two-factor authentication

1. On the sign-in page, enter your email and password.
2. Choose I use two-factor authentication.
3. Enter the current code from your app in Two-factor code, or one of your recovery codes.
4. Choose Sign in.

If you forget step 2, sign-in fails and the code field opens for you. Enter a code and try again.

Get new recovery codes

Running low, or worried someone has seen them?

1. On the Security page, choose New recovery codes.
2. Enter a current Code from your app, or your Password.
3. Choose New recovery codes again. Save the new set and choose I’ve saved them.

Your old recovery codes stop working as soon as the new ones appear.

Turn off two-factor authentication

1. On the Security page, choose Turn off.
2. Enter a current Code from your app, or your Password.
3. Choose Turn off.

If something goes wrong

• “That code didn’t match. Check your authenticator app’s clock and try again.” Codes change every 30 seconds and depend on your phone’s clock. Make sure your phone sets its time automatically, then use a fresh code.
• “Start the setup again.” The setup was interrupted. Choose Turn on again and scan the new QR code; remove the old entry from your app.
• “Too many attempts.” Wait a few minutes before trying again.
• New phone? Before you wipe the old one, sign in, turn two-factor authentication off, then turn it on again and scan the code with the new phone. If the old phone is already gone, sign in with a recovery code and do the same.