A password can be guessed, reused or phished. Two-step sign-in and passkeys add a second thing an attacker does not have. We recommend both for every owner and admin.
Authenticator app
- Open Settings, then Security.
- Choose to add an authenticator app and scan the code with an app such as Google Authenticator or 1Password.
- Enter the six-digit code the app shows to confirm. From then on you are asked for a code when you sign in.
Passkeys
A passkey lets you sign in with your device's fingerprint, face or screen lock instead of a password. It only works on the site it was made for, so it cannot be phished. Add one under Settings, then Security, on a browser or phone that supports them. If your browser does not support passkeys, the page tells you.
Keep a second way in. Add a passkey on more than one device, or keep your authenticator app backed up, so a lost phone does not lock you out.
Lost the device? Sign in another way if you can and remove the old one. If you cannot, contact support from the email address on the account and we will verify you before we change anything.