Two-factor authentication

Two-factor authentication (2FA) adds a second check at sign-in, on top of your password. Even if someone got hold of your password, they couldn't sign in without this second factor.

Prerequisite

You must first have set a password (see Change my password). Accounts that sign in only through Google or Microsoft therefore need to create one first.

Enable 2FA

1. Open Personal settings → Security.
2. Choose the method:
   • Authenticator app (TOTP — Google Authenticator, Authy, Microsoft Authenticator…);
   • Email code.
3. For an authenticator app, scan the QR code shown with your app, then enter the 6-digit code to confirm.
4. Carefully keep your backup codes (10 codes): they let you sign in if you lose access to your 2FA method.

A screenshot of the setup screen (QR code + code entry field) would help here.

Signing in with 2FA enabled

1. Enter your email and password as usual.
2. At the second-factor prompt, open your authenticator app (or your email) and grab the one-time code.
3. Enter the code to complete sign-in.

Backup codes

You can regenerate your backup codes at any time from the Security tab. Regenerating invalidates the old codes: update your saved copy. Each backup code can be used only once.

Store your backup codes somewhere safe (a password manager). Without them and without access to your 2FA method, account recovery takes longer.

Good to know

• The authenticator app generates a new code every 30 seconds; your phone's time must be set automatically, otherwise codes are rejected.
• Lost your phone and your backup codes? Contact support: recovery requires stronger verification.
• Trouble enabling it? See Troubleshooting → Sign-in & account.