Two-factor authentication

With two-factor authentication (2FA) on, signing in needs two things: your password (or an email sign-in link) and a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't get in.

Turn it on

1. Go to Security and select Turn on under Two-factor authentication.
2. Open an authenticator app — for example Google Authenticator, Microsoft Authenticator, 1Password or Authy — add an account and scan the QR code. Can't scan? Type in the key shown under it.
3. Enter the 6-digit code the app shows and select Turn on.
4. Save your backup codes. You see them once. Each one lets you sign in once without your phone.

Signing in

After your password or email link, enter the current code from the app. Codes change every 30 seconds, and each one works once.

In the Ghostunnel apps (and through the API), you'll be asked for the code too.

Lost your phone?

Enter one of your backup codes instead of a code from the app — each works once. Once you're in, go to Security, turn 2FA off and on again with your new phone, or select New backup codes.

Running low? When you have two backup codes or fewer, we remind you after you sign in.

No phone and no backup codes? Email [email protected] from the address on your account. To keep your account safe we'll need to confirm it's you, which can take a little while.

Turn it off

On Security, enter a current code from the app and select Turn off.