Two-factor sign-in

Two-factor sign-in asks for a second 6-digit code after your password, so someone who learns your password still cannot get in. You choose where the code comes from.

Authenticator app

A code from an app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy. It works without a signal and is the stronger choice.

Settings, Sign-in and security, Two-factor sign-in, Set up with an app. Scan the QR code, type the first code to confirm, and save your recovery codes. There are ten, each works once, and they are shown only this time. Keep them somewhere other than your phone.

If you lose your phone, use one of your recovery codes in place of the 6-digit code. Then make new recovery codes from the same page; the old ones stop working.

Email code

A 6-digit code emailed to your account address each time you sign in. There is nothing to install.

Settings, Sign-in and security, Two-factor sign-in, Use email codes. We email a code to prove the address works, and you type it back to turn it on.

• Each code works once and expires after 10 minutes.
• Five wrong guesses lock that code, and you can ask for a new one. You can ask for another code a minute after the last one if it has not been used yet.
• There are no recovery codes: the code comes from your mailbox each time.
• Anyone who can open your email can read the code, so keep your email account secure. If you want the strongest protection, use an app.

Changing method, turning it off

To switch between the two, turn two-factor off and set it up again. Turning it off needs your password and a current code (for email codes, we send you one when you ask). Turning it on or off signs your other devices out, and we email you whenever it changes, so a change you did not make is noticed.

Passkeys

A passkey signs you in without a password or a code, so it does not ask for a second code either.