Two-step verification
A six-digit code from an app on your phone, on top of your password - how to turn it on, and what it does and does not protect.
Two-step verification asks for a code from your phone in addition to your usual sign-in. It is the single most effective thing you can do to protect the account, because it stops somebody who already has your password.
Turning it on#
- Pick an authenticator app. Google Authenticator, Authy, 1Password, Microsoft Authenticator - any of them. The setup screen suggests some.
- Scan the QR code. If you cannot scan - setting it up on the same device you are reading this on, for instance - there is a key you can type instead.
- Enter the code the app shows to prove it worked.
- Save your recovery codes. Do not skip this step; see recovery codes.
How the codes work#
Six digits, changing every 30 seconds, generated on your device from a shared secret. Nothing is sent to your phone, so it works with no signal and on a plane.
What it protects, and what it does not#
It protects sign-in. Someone with your password cannot get in without your phone.
It does not protect a session already signed in on a device someone else has. For that, sign that session out - see active sessions and login history.
Turning it off#
You can, and you have to verify first. Doing so leaves your password as the only thing between an attacker and the account.
If you are an admin#
Admin accounts carry more risk and the platform has the machinery to require enrolment for them. Whether that requirement is currently switched on is an operational decision rather than a permanent rule, so the settings screen is the authority - if enrolment is being required of you, it will say so and give you a deadline.
Either way, an admin who has not enrolled is the weakest point in the system. Enrol before you are asked.
Was this page helpful?