Two-factor authentication

What is 2FA?

Two-factor authentication (2FA) requires a second proof of identity when you sign in on a new device. Even if someone steals your password or SIM-swaps your number, they can't get in without the second factor.

Turn 2FA on

1. Open the app and go to Settings → Account → Security.
2. Tap Two-factor authentication.
3. Choose a factor:
   • Authenticator app (recommended) — scan the QR code with Google Authenticator, 1Password, Authy, or another TOTP app.
   • Security key (WebAuthn) — tap Add a security key and pair a hardware key (YubiKey, Titan, etc.).
   • SMS — least secure; we support it but recommend an authenticator app instead.
4. Store the ten backup codes we show you somewhere safe. Each code works once.

Turn 2FA off

Only turn 2FA off if you're switching devices and can't move your authenticator. Go to Settings → Account → Security → Two-factor authentication → Turn off. We ask for a fresh 2FA code before allowing this.

I lost my second factor

• Enter a backup code if you saved them.
• If you have no backup codes, use one of your registered recovery contacts.
• If neither works, you'll need to go through the full account recovery flow. This takes 24–48 hours.

Trusted devices

You can mark up to three devices as Trusted so you don't need to enter a 2FA code on them for 60 days. Manage them at Settings → Account → Security → Trusted devices. Sign out of any trusted device you no longer control.