Security and two-factor authentication

Your sign-in is yours, shared across every account you belong to. Security in the account menu (top right) is where you manage it.

Two-factor authentication

With two-factor on, signing in needs your password and a six-digit code from an authenticator app on your phone or in your password manager (1Password, Google Authenticator, Authy and others). A stolen password alone is then not enough to get in.

Turning it on: open Security, choose Turn on, confirm your password, then scan the QR code with your app (or type the key it shows). Enter the six-digit code the app gives you to finish. You will get an email confirming the change.

Backup codes: when two-factor turns on you are shown ten backup codes. Each lets you in once if the app is out of reach; copy them somewhere safe, because they are not shown again. New backup codes replaces the set at any time (the old ones stop working).

Signing in: after your password you are asked for the code. Tick Trust this device for 30 days on a device that is yours to skip the code there for a month. Use a backup code instead takes one of your backup codes.

Turning it off: Turn off in Security, with your password. Signing in then needs your password alone. An email confirms the change; if you did not make it, reset your password straight away.

Passkeys

A passkey signs you in with your fingerprint, face or device PIN instead of a password and a code. It is made by your device or your password manager (iCloud Keychain, Google Password Manager, 1Password and others), stays there, and is never sent to us; what we keep cannot be used to sign in from anywhere else.

Adding one: open Security, choose Add a passkey, give it a name you will recognize (the device or manager it lives in) and follow your device's prompt. You will get an email confirming the change. Add one for each device you sign in from, or one in a password manager that syncs between them; the list shows which kind each is.

Signing in: choose Sign in with a passkey on the sign-in page, or pick the passkey your browser offers in the email field. No password and no two-factor code are asked for: the device has already checked it is you.

Removing one: Remove beside it in Security. An email confirms the change; if you did not make it, reset your password straight away.

Passwords

Passwords are never stored in a readable form. Forgot password? on the sign-in page sends a reset link to your address.