Two-factor authentication

An authenticator app code on top of your usual sign-in, with backup codes, for organizations whose policy requires it.

Two-factor adds an authenticator app code on top of whichever method you sign in with. It is off by default and not required.

Whether you need it

Think about what it adds on top of what you already have.

On a one-time email code, it adds a real second factor: somebody with your mailbox alone cannot get in.

On a passkey, it adds much less. A passkey is already something you have plus something you are, and it cannot be phished. Turning on two-factor here mostly adds friction.

With SAML single sign-on, do it at the identity provider instead. That is the whole point of SSO: one policy, applied everywhere, rather than per application.

So the honest answer is that it earns its place for organizations with a policy requiring it, and for anyone whose main route in is an email code.

Setting it up

Choose Account settings from the account menu at the bottom of the sidebar, open the Security tab, and choose Setup next to Two-factor authentication. Scan the QR code with your authenticator app, then enter the code it generates and the code we email you.

The emailed code stays valid for 10 minutes.

You are then given backup codes. Store them somewhere that is not the phone holding the authenticator, because the situation they exist for is that phone being lost.

Signing in with it

Your usual method, then the code from the app. A backup code goes in the same field.

Turning it off

Choose Disable next to Two-factor authentication, then enter the code we email you. The code stays valid for 10 minutes, and you need access to your mailbox to turn the second factor off.

If you lose the authenticator

Use a backup code, sign in, and set it up again on the new device.