Set up two-factor authentication

Two-factor authentication (2FA) adds a one-time code from an app on your phone to your password, so a leaked password alone isn't enough to sign in as you.

1. Go to Settings → Security and choose Turn on two-factor authentication.

2. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password and similar apps all work), or type in the secret shown beneath it if you can't scan.

3. Enter the 6-digit code your app shows to confirm it's working, then select Turn on two-factor authentication.

4. We'll show you a set of one-time recovery codes. Save them somewhere safe (a password manager is ideal). Each code works once, and they're the way back into your account if you lose your phone.

From then on, after you enter your password we'll ask for a code from your app. If you don't have your phone, use a recovery code instead and you'll be prompted to set up 2FA again on your next sign-in.

If you lose your phone

Use one of your saved recovery codes on the two-factor challenge screen, then go to Settings → Security to remove the old authenticator and set up a new one straight away.