Two-factor authentication (2FA)

Settings → My account → Security → Turn on.

1. Enter your password.
2. Scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 1Password…), or type the key shown.
3. Enter the 6-digit code to confirm.
4. Save your 10 backup codes (copy or download). Each works once if you lose your phone. They are shown only once.

From then on, signing in asks for the code after your password. Turning 2FA on signs out your other devices.

• New backup codes replaces the old ones (needs a code from the app).
• Turn off needs your password and a code.
• After 5 wrong codes, sign-in is blocked for 15 minutes and you get an email.

For administrators

• Require 2FA for administrators: administrators without 2FA can only open Settings until they turn it on.
• Reset 2FA (Settings → Users → Edit): for a colleague who lost phone and backup codes. They are emailed about it.