Two-step sign-in adds a code from your phone after your password. The code changes every 30 seconds, so someone who learns your password still cannot open your account.
Turn it on
You need an authenticator app on your phone, for example Google Authenticator, Microsoft Authenticator, Authy or 1Password.
- Sign in, open Profile, go to Change password and click Set up under Two-step sign-in. You can also click Turn on on your dashboard.
- Click Turn on two-step sign-in and enter your password.
- In your app, add an account and scan the square. If you cannot scan it, click Copy key and paste the key into the app, or on your phone click Open in authenticator app.
- Type the 6-digit code your app shows and click Turn on.
- Save your recovery codes (see below), tick I have saved these codes and click Done.
We email you whenever two-step sign-in is turned on or off.
Signing in
Enter your email and password as usual. If your account uses two-step sign-in, a code field appears: type the 6-digit code from your app and click Sign in again.
Recovery codes
If you lose your phone, each recovery code lets you sign in once. When the code field is showing, click Use a recovery code instead and type one. Keep them somewhere safe and apart from your phone: use Copy, Download or Print on the page that shows them. We show them only once. When you are nearly out of them, click Make new recovery codes on the two-step page: the old ones then stop working.
If you cannot sign in
- If the code is not accepted, check that the date and time on your phone are set automatically, then wait for the next code.
- Five wrong codes in a row pause code attempts for 15 minutes. Try again after that.
- If you have no phone and no recovery codes, open a ticket from another way of contacting us, or use live chat. We will ask for your support PIN to confirm it is you, then turn two-step sign-in off so you can sign in and set it up again on your new phone.
Turn it off
Open Two-step sign-in from your profile, click Turn off, and enter your password and a code from your app (or a recovery code).
If you made an API key in your profile, it still works without a code. Reset it in your profile if you do not use it.