Two-factor authentication

Steps

1. 1

   Go to Profile and find the Two-factor authentication section.

2. 2

   For an authenticator app: click Set up, scan the QR code with Google Authenticator, Authy, 1Password or similar — or enter the key by hand — then type the six-digit code to confirm.

3. 3

   For emailed codes: turn on email verification. A six-digit code is sent to your account email whenever a new device signs in.

4. 4

   Sign out and back in. After your password you're taken to a verification step; enter your code to continue.

5. 5

   Leave "Remember this device for 90 days" ticked and that phone or laptop won't ask for a code again for 90 days.

6. 6

   Use Forget trusted devices to force verification everywhere — do this if you lose a phone or laptop.

7. 7

   Turn either method off from the same section when you no longer want it.

Tips

• You can have both methods on at once; use whichever is handier at the time.
• Save your authenticator key somewhere safe — losing the app means losing that method.

Troubleshooting

• "Invalid code" from an authenticator app — the codes are time-based, so check the clock on your phone is set automatically.
• The email code doesn't arrive — check spam, then request a new code. Codes expire after a short window.