Two-Factor Authentication
Add a six-digit code from an authenticator app to your password sign-in, save your recovery codes, and recover when you lose the device.
By the end of this page you will have two-factor authentication turned on, your recovery codes saved, and a plan for the day you lose the phone.
Two-factor authentication means that after your password, you are asked for a six-digit code that only your authenticator app can produce. Someone who learns your password still cannot sign in without your device.
A passkey is the other way to add a second factor, and for daily use it is faster: one unlock replaces the password and the code. Both can be on at once; a passkey sign-in skips the code because the device unlock already proved it was you.
Before you begin
| You need | Why |
|---|---|
| An authenticator app | Any app that generates time-based codes: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden. |
| A password on your account | The code is asked after the password. An account that signs in with a passkey alone does not need a code. |
| A safe place for eight codes | A password manager or a printed sheet; the recovery codes are shown once. |
Turn it on
- Open Settings → Security and find the Two Factor Authentication (2FA) card. It reads Disabled.
- Press Enable Two Factor Authentication. A dialog opens with a QR code.
- In your authenticator app, add an account by scanning the code. If you cannot scan, copy the key beneath the code and enter it by hand; the app lists the entry under the application's name and your email address.
- Press Continue, type the six-digit code your app shows, and press Confirm. The code boxes submit on their own as soon as the sixth digit is in.
- The card now reads Enabled and shows your recovery codes, expanded. Save them now.
Until the code is confirmed nothing changes: the enrolment is pending, your password still signs you in alone, and closing the dialog with Cancel forgets the secret. Reloading the page mid-enrolment keeps it, so you can scan at your own pace.
Recovery codes
Enabling the factor mints eight single-use recovery codes, each shaped XXXXXXXXXX-XXXXXXXXXX. A recovery code stands in for an authenticator code once; after it is used it is spent, and the rest remain valid.
Store the codes before you leave the page. They are shown expanded right after enrolment and collapsed on later visits; you can view them again any time, but nothing reminds you to.
On the Enabled card:
- View My Recovery Codes expands the list; Hide Recovery Codes collapses it. The line beneath counts how many remain.
- Regenerate Codes replaces all eight at once, used or not. Do this when you suspect a code leaked, or when you are down to one or two.
Signing in with the code
After a correct password you are taken to the two-factor challenge. Type the code from your app, or choose login using a recovery code and paste one. Five wrong codes lock the challenge for a minute. The full flow is on Signing in.
Turn it off
- Open Settings → Security.
- On the Enabled card, press Disable Two Factor Authentication.
- The secret and every recovery code are removed at once. The next sign-in asks for the password alone.
Turn it off only to move to a new authenticator or to a passkey. Set the replacement up first, then disable the old factor.
Moving to a new phone
Before wiping the old phone, transfer the authenticator entries with the app's own export feature, or sign in and re-enrol: turn the factor off, then on again, and scan the new QR code with the new phone. If the old phone is already gone, sign in with a recovery code and do the same.
Permissions
| Action | Who may do it |
|---|---|
| Enable, disable, regenerate | You, on your own account |
| Turn the factor off for someone locked out | A workspace admin, after confirming who they are |
Frequently asked
Two-factor codes and passkeys
| Feature | Authenticator code | Passkey |
|---|---|---|
| Extra step at sign-in | Yes, after the password | No; the passkey replaces the password |
| Needs a phone | Yes | Any device or password manager that holds the passkey |
| Works offline | Yes | Yes |
| Recovery | Eight recovery codes | Another passkey, or the password |
| Phishing | A code can be typed into a fake page | Bound to this application; a fake page gets nothing |
Related
- Passkeys: the faster second factor.
- Signing in: the challenge, lockouts and recovery codes at sign-in.
- Browser sessions: sign other devices out after a scare.
How is this guide?
Last updated on
Changing Your Password
Set a new password from Account Settings → Security, what the form asks for, what happens to your other sessions, and how an account that signs in with a passkey alone sets one.
Passkeys
Register passkeys to sign in with a fingerprint, a face scan or your device lock, keep one per device, and remove the ones you no longer hold.