Set up two-factor authentication

Two-factor authentication (2FA) adds a one-time code from an app on your phone to your password, so a leaked password alone isn't enough to sign in as you.

1. Go to Settings → Security and choose Set up authenticator app.

2. Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password and similar apps all work), or type in the secret shown beneath it if you can't scan.

3. Enter the 6-digit code your app shows to confirm it's working, then select Turn on two-factor authentication.

A setup may expire if you leave it open for more than five minutes, or if you finish setting up in another tab or on another device. If you see "This setup expired — reload to start again.", reload the page, choose Set up authenticator app again and scan the new QR code (you can delete the earlier entry from your authenticator app).

4. We'll show you a set of one-time recovery codes. Save them somewhere safe (a password manager is ideal). Each code works once, and they're the way back into your account if you lose your phone.

From then on, after you enter your password we'll ask for a code from your app. If you don't have your phone, use a recovery code instead (see below).

If you lose your phone

On the two-factor challenge screen, choose Use a recovery code and enter one of your saved codes. That turns two-factor authentication off for your account straight away, removing the old authenticator, and takes you to Settings → Security, where you can set up a new authenticator app and get a fresh set of recovery codes. We also email you to say it was turned off, in case it wasn't you.