Turn on two-step sign-in

Ask for a code from an authenticator app at sign-in, and keep recovery codes safe.

In short

Two-step sign-in asks for a code from an authenticator app as well as your password, so a stolen password is not enough. You turn it on in Settings › Sign-in & security and get 10 recovery codes for the day you lose your phone.

Before you start

• Who: anyone signed in. An organization on the Business or Enterprise plan can require it of its members.
• Plan: none for you.
• First: an authenticator app on your phone, and your password.

Turn it on

1. Open Settings › "Sign-in & security" and find "Two-step sign-in".
2. Press "Turn on", type your password and press "Continue".
3. Scan the QR code with an authenticator app, or type the key shown. On a phone, "Open your authenticator app" adds the account.
4. Type the "6-digit code" the app shows now and press "Turn on".
5. Save your recovery codes with "Copy codes" or "Download (.txt)". The card now says "On".

Recovery codes are shown once You get 10 one-time codes. They are the only way in if you lose your authenticator app, and they are not shown again. Leaving without saving them asks you to confirm.

Sign in with it

1. Sign in with your email and password.
2. Type the "6-digit code" your app shows now.
3. Lost the app? Press "Use a recovery code instead" and type one code. Each code works once.

Good to know

• The code changes every 30 seconds.
• The card shows how many recovery codes are left and warns at three or fewer. "New recovery codes" (password first) makes a fresh set, and the old ones stop working.
• "Turn off" asks for your password and removes the key and every recovery code.
• A passkey counts as both steps, so signing in with one never asks for a code.
• On the Business and Enterprise plans an organization can require two-step sign-in. Members without an authenticator app or a passkey are asked to turn it on first. A member who signed in through the organization's own single sign-on, with a second factor there, is let in without one.
• Lost both the app and the codes? Support can email you a link to reset two-step sign-in, after which your password alone signs you in until you turn it on again.

If something goes wrong

• "That code did not match. Check that your phone's clock is right, then enter the code the app shows now.": set your phone's time to automatic and try the new code.
• "That code is not right. Enter the code your authenticator app shows now, or a recovery code.": type the current code, or use a recovery code.
• "This sign-in has expired. Start again with your email and password.": the code step waited too long. Sign in again.
• "Two-step sign-in is already on. Turn it off first to move it to a new authenticator.": turn it off, then turn it on with the new app.

Related

• /help/settings/passkeys
• /help/settings/signed-in-devices
• /help/settings/account-and-sign-in
• /help/organizations/organization-policies