Open the Security tab of your account, click Enable 2FA, scan the QR code with an authenticator app, and enter the 6-digit code it shows. Save the 10 recovery codes you're given. From then on, signing in and sensitive changes need a code from your app as well as your password.
Turn on 2FA
- Install an authenticator app on your phone, such as Google Authenticator, Authy or 1Password.
- In your account, open Security. Under Two-Factor Authentication, click Enable 2FA.
- Enter your password under Confirm your password and click Continue.
- Scan the QR code with your app. If you can't scan it, type the Setup key into the app instead (Copy setup key copies it).
- Type the 6-digit code from the app under Verification code and click Verify & enable.
- Save your recovery codes (see below), tick I've saved my recovery codes somewhere safe. and click Done.
We email you whenever 2FA is turned on or off for your account. If you get one of those emails and it wasn't you, contact support straight away.
Recovery codes
You get 10 recovery codes, each in the form xxxx-xxxx-xxxx-xxxx. Each one works once, in place of a code from your app, if you lose your phone. They're shown only once, so use Copy recovery codes or Download .txt and keep them somewhere safe, away from your phone.
To get a fresh set, click Regenerate recovery codes, enter your password and a current code from your app (or a recovery code), and click Regenerate. Your old codes stop working.
Signing in with 2FA
After your username and password, the sign-in page asks for a Two-factor code. Enter the 6-digit code from your app, or one of your recovery codes, and click Verify code. Each code can be used only once, so if a code has already been used, wait for the app to show the next one.
2FA is also asked for when you change your password, export your data or delete your account. Changing your password accepts a recovery code; export and deletion need a code from your app.
Turn off 2FA
- On the Security tab, click Disable 2FA.
- Enter your password and a Current code from your app, or a recovery code.
- Click Disable 2FA.
Turning 2FA off signs you out of every session, including this one, so sign back in afterwards.
Too many attempts
- At sign-in: after 10 wrong codes in 15 minutes, sign-in is paused and the page says "Too many failed sign-in attempts — try again in a few minutes."
- When you confirm a change: setting up or turning off 2FA, regenerating recovery codes, changing your password, setting or removing an SFTP password, exporting your data and deleting your account all ask you to confirm it's you. A wrong password or code answers "Password or code is incorrect." After 10 tries in an hour without a successful one, these confirmations are refused for the rest of that hour with "Too many failed attempts to confirm it's you — try again later." A successful confirmation resets the count, and so does resetting your password from the sign-in page.
Lost your phone and your recovery codes
If you still have a recovery code, sign in with it, then turn 2FA off and on again with your new phone, or regenerate your codes. If you have neither your app nor a recovery code, email [email protected] from the address on your account, or open a ticket. Staff can remove 2FA from an account; that signs it out everywhere, and you then set 2FA up again.