With two-step verification on, a stolen password is not enough to get into your account. After your password, you also enter a 6-digit code from an authenticator app on your phone, such as Google Authenticator, 1Password or Authy. The app is free, and it shows a new code every 30 seconds.
Turn it on
Open Security
Sign in, open your Account page and choose Security. Under Two-step verification, select Set up two-step verification.
Confirm your password, then start
If your account has a password, enter it under Confirm your password. If you sign in with Google or a magic link, you have no password to confirm. Then select Start setup.
Scan the code
Scan the QR code with your authenticator app. If you cannot scan it, use the key shown under Can't scan? Enter this key manually.
Confirm it works
Type the current code from the app into Enter the 6-digit code and select Confirm. Codes change every 30 seconds, so if it is refused, try the one showing now.
Save your backup codes
Save the backup codes somewhere safe, tick I've saved my backup codes somewhere safe, then select Done. Two-step verification is now on.
Manage it later
Once it is on, the Security page shows Authenticator app with an On label and two actions:
- Generate new backup codes replaces your old set. Codes you saved before stop working, so save the new ones right away.
- Turn off removes the second step. Your account is then protected by your password alone, and you stop being asked for a code.
If your account has a password, you confirm it before either action. Having trouble at sign-in? See My two-step code isn't working, or I lost my phone.