Two-step sign-in and recovery codes

FAQs

A second step after your password: a passkey, an authenticator app, or an emailed code. Turn it on, change it or turn it off yourself.

1. Open "Two-step sign-in" from your account menu, or Account → Security. The card at the top says whether it is on, and how.
2. Press "Turn on two-step sign-in" and choose: a passkey (recommended — your fingerprint, face or screen lock), an authenticator app (scan the QR code, type the 6-digit code it shows), or a code we email. The emailed code needs a confirmed email address.
3. Adding a passkey or an app also gives you ten recovery codes, shown once. Tick "I have saved these codes" before closing — download them as a text file or copy them somewhere safe, away from your phone.
4. Once you have a passkey or an app, emailed codes are no longer accepted for your account, so somebody who gets into your inbox still cannot get in.
5. When three or fewer recovery codes are left, the Security page says so. Press "Make new codes": the old ones stop working.
6. To turn it off, press "Turn off two-step sign-in" on the card (only possible while you use emailed codes). It explains what changes and asks you to confirm. With a passkey or an app it stays on; remove those first if you really want it off.

• Every change asks you to confirm it is you — with your passkey, app or a recovery code when you have one, never only an emailed code — and is emailed to you. If you get one of those emails and it was not you, reset your password straight away.
• Staff accounts always use two-step sign-in, and must have a passkey or an authenticator app.