Turn on two-factor authentication
In Settings, Security, turn on two-factor authentication with an authenticator app (TOTP) or a code sent by email. It is off by default.
Updated September 24, 2026
Two methods, pick one
- Authenticator app (Google Authenticator, 1Password, Aegis and others): scan the QR code shown and enter the 6-digit code. Keep the backup codes safe.
- Email code: a code is sent to your address at each sign-in. Your inbox is your backup.
Sessions
The same page lists signed-in devices. Sign out one device or all others; a revoked session can stay open for up to 5 minutes. If you lose your phone, sign in with a backup code, then remove the old authenticator.
Ready to print a QR code that never dies?
7 days for $0, card required, a reminder 2 days before the first charge, cancel in 2 clicks.