Two-factor authentication

With two-factor authentication, every sign-in asks for a 6-digit code from your phone on top of your password. Even if someone guesses your password, they can't get in.

Turn it on

You need an authenticator app (Google Authenticator, Authy, 1Password…).

1. Go to Settings › Security › Two-factor authentication, then tap Turn on two-factor authentication.
2. Scan the QR code with your app, or type the key by hand. Keep that key somewhere safe.
3. Confirm with your current password, then enter the 6-digit code shown by the app.

Next time you sign in, you'll be asked for a code after your password. The code is also asked for to change your password or your email address, and to delete your account.

It protects signing in with a password. If your account only signs in with Google or Apple, without a password, it isn't offered: those sign-ins don't ask for it. Set a password first (Settings › Security) to be able to turn it on.

Turn it off

In Settings › Security › Two-factor authentication, tap Turn off two-factor authentication, then confirm with a code from your app or your password. We send you an email and sign out your other sessions.

You lost your phone

If you kept the setup key, add it to the authenticator app on your new phone: the codes come back.

Otherwise, write to us from your account's email address: see Contact support. Once we've checked, we remove two-factor authentication, sign out your open sessions and let you know by email. You can then turn it back on.

Resetting your password isn't enough: two-factor authentication stays on, which is what protects your account if someone gets into your mailbox.

Sign out sessions opened elsewhere

Signed in at a friend's place, or worried someone got in? In Settings › Security › Connected devices, tap Sign me out everywhere else. The session you're using stays open.