Skip to main content
Two-factor sign-in asks for a 6-digit code from an authenticator app after your password. Someone who learns your password still can’t sign in without your phone. Each person turns it on for their own account.

​
Turn it on

1

Open Settings → Account

Find the Two-factor sign-in card and select Turn on.
2

Confirm it's you

Enter your password and select Continue. If you only sign in with Google or GitHub, there is no password to enter.
3

Scan the QR code

Use any authenticator app: 1Password, Google Authenticator, Microsoft Authenticator, Authy. If you can’t scan, type the key shown beside the code. Then enter the 6-digit code the app shows and select Verify and turn on.
4

Save your backup codes

You get ten backup codes. Copy or download them and keep them somewhere safe. This is the only time they are shown.
Two-factor sign-in only switches on after the first code checks out, so an unfinished setup can’t lock you out.

​
Signing in with it

After your email and password, the sign-in page asks for the code from your app. Tick Don’t ask again on this device for 30 days to skip the code on a computer you trust. Lost your phone? Select Lost your phone? Use a backup code and enter one of your backup codes. Each one works once. After 10 wrong codes in a row, the account is locked for 15 minutes. Signing in with Google or GitHub doesn’t ask for a code. Those providers run their own second factor, so turn it on there too.

​
New backup codes, or turning it off

On the same card, New backup codes replaces your codes with ten fresh ones, and the old ones stop working. Turn off switches two-factor sign-in off. Both ask for your password first, if your account has one.