Two-Factor Authentication

Two-factor authentication adds a six-digit code from your phone to every sign-in. It uses standard TOTP, so any authenticator app works: Google Authenticator, Aegis, 1Password, Bitwarden.

1. 1Go to Settings → Security → Two-factor authentication
2. 2Press Turn on
3. 3Press Show the code and scan it with your authenticator app, or type the key under it into the app by hand
4. 4Type the six-digit code the app shows, and press Verify and turn on
5. 5Save the backup codes you are given: Download codes keeps them as a file

The QR code and the key are deliberately hidden until you press Show the code: you are usually setting this up somewhere other people can see your screen.

Backup codes are for the day you cannot reach your authenticator. Each one works once, and using one to sign in turns two-factor off: it removes your authenticator, the sign-in tells you so, and you set 2FA up again under Settings → Security.

While 2FA is on, Settings → Security shows how many of your codes are left, and New codes replaces the whole set. Old codes stop working the moment new ones exist.

When you enter your code at sign-in you can check Remember this device for 14 days. For those 14 days, signing in on that browser takes your password and skips the code. Every other browser still asks for it, and we email you each time a browser is remembered.

Settings → Security shows how many browsers are remembered, and Forget all ends them at once. Turning 2FA off or making new backup codes still asks for your code on a remembered browser.

No authenticator app? Settings → Security → Codes by email → Use email sends a six-digit code to your account's address; enter it, and from then on every sign-in to the dashboard asks for a fresh code by email after your password. Each code works once, for 10 minutes. Turning it off asks for a code by email too.

Settings → Security → Two-factor authentication → Turn off, and confirm it. If you started turning 2FA on and never finished, the same card shows a Continue setup button rather than leaving you stuck halfway.