Turn on two-step verification

Steps

1. Open the Account tab, then Security.
2. Click Turn on in the Two-step verification card.
3. That is all: nothing to install, nothing to scan. It applies from your next sign-in.

Two methods, one at a time

Since 17 September 2026 the code can come from an authenticator app on your phone — Google Authenticator, 1Password, Bitwarden, Aegis — instead of an e-mail. The app works the code out on its own, with no network: it works on the underground, on a plane, and a mailbox you cannot reach no longer locks you out.

You pick one, and only one can be on: to move from one to the other, turn off the one in place first.

This is not a technical limit but a security one. Your mailbox already resets your password: if the verification code arrived there too, anyone taking control of it could reset the password, have the code sent, and walk in — the app would protect nothing. Keeping them apart keeps two locks that do not open with the same key.

Setting the app up

In Account ▸ Security, card Authenticator app, click Set up. A QR code appears: scan it with your app. If you cannot scan it — a computer with no camera, an app that does not offer it — type in the key written just below.

Your app then shows a six-digit code that changes every thirty seconds. Copy it to finish: that is what proves the secret arrived. Nothing is saved before that step — a setup you abandon halfway changes nothing on your account.

Your recovery codes, not on the phone

When you turn it on, eight recovery codes appear. They will never be shown again: write them down, print them, put them in your password manager — anywhere except the phone that carries the app, since losing that phone is exactly what they are for.

Each one works once. When signing in, the I do not have my phone link opens the box to type one in. It is the only way back if you lose the device: the e-mail code is not on at the same time, so it cannot help. The Security card tells you how many are left, and warns you when only two remain. The New codes button makes eight fresh ones: the old ones stop working then.

What you will see when signing in

After your password, a screen asks for the code. It is valid for fifteen minutes and works once. Send a new code issues another one if the first never arrives — do check your spam folder.

Devices you chose to remember

If you tick "Remember me" when signing in, that device is not asked for a code again: it was already approved once, code included. The Remembered devices card forgets them all at once, and the code becomes necessary everywhere again.

Turning it off also asks for a code

Turning the verification off removes the protection, so the Turn off button sends a code to your address and waits for you to enter it. Until it is confirmed, nothing changes. That is what stops someone who finds your session open — an unlocked computer — from removing it in one click.

If you lose access to your mailbox

That is the thing to weigh before turning it on: the code goes to your account address, and only there. If you can no longer read it, write to support from the contact form — we can turn the verification off once we have checked it is really you.