Two-factor means a password on its own is not enough to get into your account. We support an authenticator app, an emailed code, and passkeys.
Turning it on
Dashboard, Account, then Two-factor. Scan the QR code with an authenticator app, then enter one code to prove it works. It is not active until you confirm that code.
Backup codes: read this part
When you turn two-factor on we give you a set of backup codes. Each one works once. They exist for the day your phone is lost, stolen or wiped, and that is exactly the day you will not be able to generate new ones.
Save them somewhere that is not the phone with the authenticator on it. A password manager is ideal. Your dashboard shows how many you have left, and you can generate a fresh set at any time, which retires the old ones.
If you cannot use your app
Three ways past the prompt: a backup code, a code emailed to the address on your account, or a passkey if you registered one. See if you get locked out for what happens when none of those are available.
Passkeys
A passkey uses your device unlock, so a fingerprint or your face instead of typing a code. You can register more than one, which is worth doing if you use more than one device.
Turning it off
Same screen, while signed in. We will not turn two-factor off because an email asked us to. If we did that, two-factor would not be protecting anything.