Two-factor sign-in

With two-factor sign-in on, signing in takes your password and a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't get in without your phone.

Turn it on

1. Open your Account page.
2. Under Two-factor sign-in, click Turn on and enter your password.
3. Scan the QR code with an authenticator app, such as Google Authenticator, Microsoft Authenticator or 1Password. If you can't scan it, type the key shown below the code into the app.
4. Enter the 6-digit code the app shows and click Turn on.
5. Save your 10 recovery codes: download them or copy them somewhere safe, then click I've saved them. They are shown only this once.

Turning it on signs you out on your other devices. We email you whenever two-factor sign-in is turned on or off, so you would notice a change you didn't make.

If you sign in with Google or Microsoft and have no password, you skip the password step.

Signing in

After your password, enter the code your app shows. Each code works once. Signing in with Google or Microsoft asks for the code too.

If you lose your phone

On the sign-in page, click Lost your phone? Use a recovery code and enter one of your recovery codes. Each one works once. Then set it up on your new phone: on your Account page, turn two-factor sign-in off with another recovery code, and turn it on again.

If you have no recovery codes either, contact support from your account's email address. Once we turn it off, you get an email and can sign in with your password.

New recovery codes

Your Account page shows how many recovery codes are left. Click New recovery codes and enter a code from your app to get 10 new ones. The old ones stop working.

Turn it off

Click Turn off, then enter your password and a code from your app or a recovery code.