Turning On Multi-Factor Sign-In for Your Account

Availability: all plans

Multi-factor authentication adds a second step to signing in. After your password, you also enter a six-digit code from an authenticator app on your phone, so a stolen password alone cannot open your account. This guide shows how to turn it on for your own account, what to save when you do, and how to turn it off again. The same pages are used by everyone who signs in, including customers.

Before you start

You need a phone with an authenticator app installed, such as Google Authenticator, Authy or Microsoft Authenticator. Multi-factor sign-in is included in every plan and needs no special permission: every signed-in user manages their own account. Each person turns it on for themselves, and one person cannot turn it on for another.

Steps

Open the user menu and choose Security. The page is titled Security and shows cards for Password, Multi-Factor Auth, Sessions and Login History.
Choose the Multi-Factor Auth card. If you have not set it up yet, it shows Not Enabled, and a yellow Security Recommendation box also offers an Enable 2FA link to the same place.
On the Multi-Factor Authentication page, the Two-Factor Authentication card shows its status as Disabled. Choose Set up 2FA.
Under Step 1 — Scan this QR code, open your authenticator app and scan the picture. If you cannot scan it, type the Manual entry key shown below the picture into the app. The small copy button next to the key copies it.
Under Step 2 — Confirm setup, type the six-digit code your app now shows into Authenticator code. Spaces in the code are fine. Choose Verify and enable.
A page headed Two-factor authentication enabled! shows your recovery codes. Save them now: choose Download codes to save a text file, or Copy codes to copy them. Each code works only once, and they are shown only this one time.
Choose I've saved my codes — continue. The status now reads Enabled, and the Security page card shows Enabled.

To turn it off later:

Open Security, then Multi-Factor Auth, and choose Disable 2FA.
On Confirm: disable two-factor authentication, enter your current code in Authenticator code and choose Disable two-factor authentication. Choose Cancel to keep it on.

Tips

Choose Cancel during setup if you scan the wrong account or change your mind; nothing is enabled until you choose Verify and enable. Store the recovery codes somewhere other than the phone that holds the authenticator app, such as a password manager or a printed copy kept safe. Turning it off lowers your account security, which is why the product asks for a current code first.

If something goes wrong

If the code is rejected during setup, check that your phone clock is correct, wait for the app to show a fresh code, and enter it again; the page stays on the setup step. If you leave the setup page before verifying, choose Set up 2FA again to start over with a new QR code. If you have lost your phone and your recovery codes, you cannot disable it yourself because the product needs a current code, so contact ServiceVisit support. See the guide on signing in and recovery codes for the other cases.

Signing In with Multi-Factor and Using Recovery Codes — Once multi-factor authentication is on, signing in takes two steps: your password, then a code. This guide explains the second step, what to do when you cannot use your authenticator app, how to…