Set up two-step sign-in and passkeys
On every plan
Two-step sign-in asks for a second factor after your password, so a stolen password alone does not open your account. Open Settings, Security and select Manage two-step sign-in. Add an authenticator app or a passkey, then keep your recovery codes somewhere safe.
Add an authenticator app
- Select Turn on an authenticator app. Any app that makes time-based codes works, such as Aegis, Google Authenticator or 1Password.
- Scan the QR code with the app, or type the key into the app by hand.
- Enter the code the app shows, to turn it on.
From then on, you enter a code from the app each time you sign in.
Add a passkey
A passkey signs you in with your device's screen lock or a security key. Select Add a passkey and confirm in your browser. You can add more than one.
With a passkey you can sign in without your password: select Sign in with a passkey on the sign-in page. Otherwise you sign in with your email address and password. There is no sign-in with a Google or Microsoft account.
Keep your recovery codes
When you set up your first app or passkey, we make 10 recovery codes. You can show or download them on the same page. Keep them somewhere other than the phone that holds your app.
Each code signs you in once, when your app or passkey is out of reach. Make new codes replaces them, and the old codes stop working at once.
If you lose your phone
At the code prompt, enter one of your recovery codes instead of the app's code. If you have a passkey, you can use it there instead. Then turn the authenticator app off, turn it on again with your new phone, and make new recovery codes.
If you lose everything
If you have lost every second factor and every recovery code, write to support from the email address you sign in with. We check that the account is yours before we turn two-step sign-in off.
Optional for everyone
Two-step sign-in is optional on every account. An organization cannot require it of its members.
Published 27 October 2026 · Checked 27 October 2026