How to turn on two-step verification and passkeys
Link an authenticator app, save your backup recovery codes, or add a passkey or security key — so no one can sign in even if your password leaks.
On this page
With two-step verification on, you verify a second time when signing in and for other sensitive actions, so even if your password leaks, no one else can sign in. Some accounts must turn it on before using other features — you’ll be prompted after signing in.
Turn on an authenticator app
First install an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password.
Open Settings → Sign-in & security
Under Two-step verification, find Authenticator app and choose Set up. You can also get here from the two-step verification prompt on Home.
Scan the QR code with the app
Scan the QR code on the page with your authenticator app. If you can’t scan it, enter the key shown on the page into the app manually.
Enter the 6-digit code
Enter the 6-digit code shown in the app and choose to verify and turn on.
Save your backup recovery codes
A dialog asks you to save your backup recovery codes. Choose Copy all or Download and store them somewhere safe other than your phone (a password manager, for example), then confirm you’ve saved them to continue.
Backup recovery codes are shown only once
If you lose your phone or can’t use the authenticator app, you’ll sign in with a recovery code — each one works only once. If you close the dialog without saving them, that set stops working; you can generate a new set later under backup recovery codes on this page.
How signing in changes
After entering your password, you’ll also enter the current 6-digit code from your authenticator app. If your phone isn’t with you, choose the option to use a backup recovery code instead.
Viewing a service’s delivery details and closing your account will also ask you to complete two-step verification.
Add a passkey
A passkey lets you sign in with your fingerprint, face or device screen lock instead of a password, and it can’t be phished.
Open Settings → Sign-in & security
Under Sign-in methods, find Passkeys and choose Add (if you’ve already added one, choose Manage and add another).
Confirm when prompted
Follow your browser or system prompts and confirm with your fingerprint, face or screen lock. You’ll see a confirmation once it’s added.
From then on, choose to sign in with a passkey on the sign-in page. You can remove passkeys you no longer use in the same place.
Browser doesn’t support passkeys?
If the page says your browser doesn’t support them, switch to the latest Chrome, Safari or Edge.
Add a security key
If you have a USB / NFC hardware security key (such as a YubiKey), go to Settings → Sign-in & security, find Security keys under Two-step verification and choose Manage to add it. From then on, confirm the second sign-in step by inserting the key (or using a passkey on this device) — it’s more phishing-resistant than codes.
Before changing phones
Codes live only in your original authenticator app. Before switching phones, move your authenticator to the new phone, or unlink the old authenticator in Sign-in & security and link it again on the new phone. If you’ve already switched and can’t sign in, see Can’t use two-step verification or lost your phone?.
Never share your codes
One-time codes and recovery codes are for you alone. Our staff will never ask for them — don’t send them to anyone, including people who claim to be support.
Updated 2026-11-10 · 2 min read
Was this article helpful?
Still stuck?
Submit a ticket or contact support and we’ll get back to you soon.