Two-step verification

Two-step verification adds a second step when you sign in with an emailed code or with Google or Microsoft: a code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password. Signing in with a passkey doesn’t ask.

You turn it on and off on your Account page: choose Main menu, then Account.

Turn on two-step verification

Under Two-step verification, select Turn On.
Scan the code on screen with your authenticator app. If you can’t scan it, type the key shown under it into the app.
Enter the six-digit code the app shows.
Select Verify.
Save your recovery codes: select Copy or Download, and keep them somewhere safe.
Select Done.

You see “Two-step verification is on.” and On beside the heading.

Each recovery code signs you in once if you lose your phone.

Get new recovery codes

Select New Recovery Codes.
Enter the code your authenticator app shows now, or a recovery code, in Code from your authenticator app.
Select Get New Codes.
Save the new codes, then select Done.

Your old recovery codes stop working straight away.

Turn off two-step verification

Select Turn Off.
Enter the code your authenticator app shows now in Code from your authenticator app. You must enter a code: this stops anyone else at your computer turning it off. Lost your phone? Enter a recovery code instead.
Select Turn Off again.

You see “Two-step verification is off.” Each change to two-step verification is also emailed to you.

If you’ve turned on two-step verification, signing in with an emailed code or with Google or Microsoft takes you to Two-step verification next.

Open your authenticator app and find the six-digit code.
Enter it in Code.
Select Verify.

Without your phone, select Use a Recovery Code Instead and enter a recovery code. Each works once.

Who can do this

Everyone who is signed in, for their own account. A Global Admin can turn it off for someone who has lost both their authenticator app and their recovery codes.

If something goes wrong

“That code isn’t right.” Check that your phone’s clock is right, and enter the code the app shows now. Codes change every 30 seconds.

“Too many wrong codes. Wait 15 minutes, then try again.” After 10 wrong codes in a row, two-step verification is locked for 15 minutes. Wait, then try again.

“That looks like a recovery code. Select Use a Recovery Code Instead.” You entered a recovery code in the box for your app’s code. Select Use a Recovery Code Instead, then enter it there.

You left the page before saving your recovery codes While your recovery codes are on screen, leaving the page asks first: you won’t see them again. If they’re lost anyway, select New Recovery Codes.

You’ve lost your authenticator app and your recovery codes Contact your organisation’s admin. A Global Admin can turn two-step verification off for you, once they’re sure it’s you.