Two-step sign-in
Turning it on, the backup codes, and what to do if you lose the phone.
Open this page
Reviewed 24 September 2026
Step by step
- Open Sign-in security Under Settings in the portal menu.
- Scan the code with an authenticator app Any of them — Google Authenticator, Aegis, 1Password, your password manager.
- Enter a code to arm it It is only turned on once a code from your app has been accepted, so it cannot be armed against a phone that never worked.
- Save the backup codes somewhere that is not the phone Each is usable once. They are the way back in when the phone is gone.
- Test it by signing out and in Better to find a problem now than at a registry counter.
Worth knowing
- A code that has already been used is refused, even inside its thirty seconds. Reading one out across a room does not let somebody else in behind you.
Questions
I have lost my phone and my codes.
Contact support from the email address on the account. Recovery is deliberately slow and manual, because a fast one is a way in for somebody else.
Can I turn it off?
Yes, from the same page, with your password.
Next
All guides
Reviewed 24 September 2026