Two-factor authentication

Two-factor authentication adds a second step to signing in. As well as your password, you enter a six digit code from an app on your phone. If someone learns your password, it is not enough on its own to get into your account.

It is available on every plan, free and Pro, and it is entirely optional.

Setting it up

Install an authenticator app on your phone if you do not already have one. Google Authenticator, Microsoft Authenticator, Authy and 1Password all work.
Go to two-factor setup.
Scan the QR code with your authenticator app.
Enter the six digit code the app shows you, to confirm it is working.

We ask for that first code deliberately. It proves the app is set up correctly before we start requiring it, so you cannot lock yourself out during setup.

Recovery codes

When you finish setting up, we give you a set of recovery codes. Each one can be used once, in place of a code from your app.

These matter. If you lose your phone, replace it, or delete the authenticator app, your recovery codes are how you get back in. Save them somewhere you can reach without your phone: a password manager, or printed and kept somewhere safe. Do not keep them only on the phone that has the authenticator app on it.

Signing in with two-factor turned on

Enter your email and password as usual. We then ask for the six digit code from your app. You can enter one of your recovery codes here instead if you need to.

If you sign in with a passkey, we do not ask for a second code. A passkey already combines your device with your fingerprint, face or PIN, so it satisfies the same requirement on its own.

Turning it off

You can turn two-factor authentication off from your profile. We ask for your password first, so that someone who finds your screen unlocked cannot quietly remove it.

The reminder after you sign in

If you do not have two-factor authentication set up, we show you a page about it after you sign in. Choosing "remind me later" puts it away for a week. It is a prompt, not a requirement, and you can keep dismissing it.

If you are locked out

Use one of your recovery codes. If you have lost both your phone and your recovery codes, get in touch. We will need to verify who you are before we can help, and that is deliberately not quick, because an easy route around two-factor authentication would defeat the point of it.