Two-factor authentication

Two-factor authentication asks for a six-digit code from an authenticator app in addition to your password. It is the single most effective thing you can do to protect an account.

Turning it on

Settings → Security → Two-factor authentication. You will:

1. Confirm your password.
2. Scan a QR code with an authenticator app (1Password, Bitwarden, Google Authenticator, Aegis and others all work).
3. Enter a code to prove it is set up.
4. Save your recovery codes. This is the step people skip and regret.

Recovery codes

You get a list of one-time codes. Each works once, in place of your authenticator, and they are the only way back in if you lose your device. Put them in your password manager or print them and keep them somewhere safe. Do not store them on the same phone as the authenticator.

If you use some and want a fresh set, regenerate them from the same page; the old list stops working immediately.

Losing your device

Use a recovery code to sign in, then turn two-factor off and on again with your new device. If you have neither the device nor a recovery code, no one in your workspace can restore access for you: contact support from the email address on the account, and expect to prove who you are.

When a workspace requires it

An administrator can require two-factor for everyone in a workspace. If they do and your account does not have it, you are sent to a page explaining that and given a link to turn it on; the security page stays reachable so you can. Once it is on, you are straight back in.

Requiring it does not sign anybody out, and the person who turns the requirement on must have two-factor themselves, so the setting cannot lock out the whole workspace.

Passkeys

A passkey is stronger than a code from an app, because it cannot be phished or typed into the wrong site. If your devices support them, consider adding a passkey as well.