Two-factor authentication

Two-factor authentication

Two-factor authentication adds a second check after your password, so a stolen password alone is not enough to get into your account.

Your options

• Authenticator app. An app on your phone shows a code that changes every thirty seconds or so. Enter it when you sign in.
• Passkey. Use a passkey as your second factor instead of a code.
• Recovery codes. A set of one-time codes you can use if you lose your phone or passkey.

Turn it on

1. Sign in and open your security settings.
2. Choose two-factor authentication and pick an authenticator app or a passkey.
3. Follow the steps on screen and confirm with the first code.
4. Save your recovery codes.

Because this changes how your account is protected, we may ask you to confirm your password or passkey first.

Recovery codes

Store your recovery codes somewhere safe and separate from your phone, such as a password manager or a printed copy kept at home. Each code works once. We store only a scrambled form of them, so we cannot show them to you again; you would need to create a new set.

If you lose access

Use a recovery code to sign in, then set up a new authenticator or passkey. If you have no recovery codes and no second factor, use the contact link at the bottom of this page. We will need to confirm that the account is yours, so expect some questions.

Secrets we keep

Your authenticator secret is stored encrypted. For more on signing in, read Sign-in options and passkeys.