Turn on two-step verification

Two-step verification asks for a six-digit code from an app on your phone after your password. It takes about a minute to set up, and you only do it once.

Before you start

Install an authenticator app on your phone: Google Authenticator, Microsoft Authenticator, 1Password, Authy or similar. You also need a verified email address on your account.

Set it up

1. Sign in and open your Profile.
2. Under Two-step verification, choose Turn on two-step verification. You may be asked to confirm it’s you first.
3. Scan the QR code with your authenticator app. If you can’t scan it, type the key shown under Can’t scan it? into the app by hand.
4. Choose Next, then enter the six-digit code the app is showing now.
5. Save your backup codes. You get ten, and this is the only time they are shown. Copy, Download or Print them, and keep them somewhere other than your phone.
6. Tick I’ve saved my backup codes, then choose Turn on two-step verification.

Turning it on signs you out on your other devices. Sign in again there with your password and a code.

On a shared or borrowed computer

Print or copy the backup codes rather than downloading them. A downloaded file stays behind for whoever uses the computer next.

Signing in from now on

1. Enter your email and password as usual.
2. On Two-step verification, enter the code from your app. It goes through on its own once you type the sixth digit.

If you added a passkey, you can choose Use your passkey instead of typing a code. See Sign in with a passkey.

When your organization requires it

Your organization may require two-step verification for everyone. You’ll then see a reminder after you sign in: Set up two-step verification by a date. Choose Set it up to go straight to your Profile. After that date, you’ll be asked to set it up before you can carry on.

If your organization works with protected health information, two-step verification is always required.

Your backup codes

Each backup code works once, in place of a code from your app. Your Profile shows how many you have left. When you’re down to two, choose Generate new backup codes. Your old codes stop working straight away.

Turning it off

On your Profile, choose Turn off two-step verification and enter a code. Your password alone will sign you in again, and you are signed out on your other devices. If your organization requires two-step verification, you’ll be asked to set it up again.

Something wrong or unclear on this page? Tell us and we’ll fix it.