How do I turn on two-step login?

Two-step login is always on: after your password, we email you a 6-digit code. To use an app instead, open Security from your profile menu, choose Manage how you log in, then under Authenticator app scan the code with an app on your phone, type its 6-digit code, and choose Turn on. Then make recovery codes.

Turn on the authenticator app

1. Open your profile menu (Your profile and settings) and choose Security.

2. Under How you log in, choose Manage how you log in. If your last login wasn't recent, we ask you to log in again first.

3. Under Authenticator app, scan the code with an app like Google Authenticator or 1Password, or type in the Key below it.

4. Type the 6-digit code from the app, and choose Turn on.

From now on, after your password, the login asks for the code from your app instead of emailing one.

Make recovery codes

If you lose your phone, each recovery code logs you in once, instead of the app.

1. On the same page, under Recovery codes, choose Make recovery codes.

2. Choose Show my codes, and save them somewhere safe, like a password manager or printed at home.

3. Choose I've saved them.

To use one, choose Use a recovery code instead when the login asks for your app's code.

Or use a passkey

A passkey logs you in with your fingerprint, your face or your screen lock, on this device or your phone. Under Passkeys, choose Add a passkey. Nobody can guess a passkey or trick you into typing it on a fake page.

Check where you're logged in

Back on Security, Where you're logged in lists each browser and device. Choose Log out on any you don't recognise, or Log out everywhere.

Read more in Login security.