Keep your account safe

Two ways to make sure only you can sign in. Both are on Your account → Sign-in.

A passkey (the easiest)

Your phone's fingerprint, face or PIN signs you in, with no password. Under Passkeys, give it a name and add it. A passkey sign-in never asks for a code: it's already two checks in one.

An authenticator app

After your password (or an emailed sign-in link), whodo asks for a 6-digit code from an app on your phone: Google Authenticator, Microsoft Authenticator, 1Password and others.

1. Under Authenticator app, tap Set up an authenticator app. (If it's been a while, sign in again first.)
2. In your app, add an account and scan the code on the screen. Can't scan? Type the key shown under it.
3. Type the 6-digit code the app shows, then Turn it on.
4. You get 10 backup codes. Each works once, if you lose your phone. Save them somewhere safe (a password manager, or on paper), then tap I've saved them. You won't see them again.

Signing in with it

Enter your email and password as usual. Then type the code from the app. No phone? Tap Use a backup code instead.

A code works once. Five wrong codes and you start the sign-in again; too many in a row and you wait a few minutes.

Out of backup codes, or a new phone?

• New backup codes (with a code from the app) gives you 10 new ones; the old ones stop working.
• Turn off (with a code from the app, or a backup code) turns it off. Then set it up again on the new phone.

Right after you turn it on, you can Sign out everywhere else: your other devices then need your password and a code.

We email you whenever the app is turned on or off, when you sign in from a browser we haven't seen, and when five wrong codes come in a row at sign-in (someone has your password: change it).

Lost your phone and your backup codes?

Email [email protected] from your account's email address.