Two-factor authentication (2FA) adds a second step when you sign in: after your password, you enter a short code from an app on your phone. Even if someone learns your password, they can’t get in without your device. Setup takes a couple of minutes.

What you’ll need

An authenticator app on your phone — any standard TOTP app works (Aegis, Google Authenticator, 1Password, Bitwarden, and others). We don’t use SMS codes.

Turning it on

1. Sign in and go to Account → Update Account Information.
2. Near the top, type your normal login password into the Current Password field. That is the box that authorizes the change — leave “New Password” and “Confirm Password” blank unless you’re also changing your password.
3. Tick Enable Two-Factor Authentication. A QR code appears.
4. In your authenticator app, add a new account and scan the QR code (or type in the secret it shows).
5. Enter the current 6-digit code from the app into the One Time Password box.
6. Click Update Account Information.

From then on, signing in asks for your 6-digit code after your password.

Turning it off

Go back to Account → Update Account Information, untick Enable Two-Factor Authentication, type your password into the Current Password field, and click Update. Turning 2FA off always requires your password, so a forgotten, still-logged-in browser can’t quietly remove it.

Lost your phone or authenticator?

If you can still sign in, just turn 2FA off (above) and set it up again on your new device. If you’re locked out, open a support ticket and we’ll verify you and help you back in.

A note on security

Two-factor protects your sign-in, so it is always managed from your account with your password — never through an API key or an agent session. That way a stored key can never be used to switch off the very protection guarding your account.