Two-step sign-in

With two-step sign-in, you enter a 6-digit code from an app on your phone each time you sign in, as well as your password. Anyone who learns your password still can't sign in without your phone.

You need an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password. They're free.

Setting it up

Open Your profile from the user menu at the top right. The Two-step sign-in box is at the bottom.

1. Click Set up two-step sign-in. A QR code appears.
2. Open your authenticator app, add an account and scan the QR code. If you can't scan it, type in the key shown next to it instead.
3. Enter the 6-digit code the app shows under Code and click Turn on.

The box now shows On.

Your recovery codes

Once it's on, you're shown 10 recovery codes. Each one lets you sign in once without your phone, for example if it's lost or broken.

They're only shown this once. Click Copy the codes and keep them somewhere safe, such as a password manager, or print them.

The Two-step sign-in box shows how many recovery codes you have left. To get a fresh set, enter your password under Your password and click Make new recovery codes. The old codes stop working.

Signing in

Enter your email and password as usual. On the next page, Enter your code, type the 6-digit code from your authenticator app and click Sign in.

Lost your phone? Click Lost your phone? Use a recovery code, type one of your recovery codes and click Sign in. Each code works once. Then set up two-step sign-in on your new phone (see below) as soon as you can.

No phone and no recovery codes? Ask the Owner or an Admin to reset two-step sign-in for you. See Resetting it for someone.

Moving to a new phone

Sign in as usual (with a recovery code if your old phone has gone), then:

1. On Your profile, click Move to a new phone.
2. Scan the new QR code with the authenticator app on your new phone.
3. Enter the code it shows and click Turn on.

Your old phone's codes stop working, and you get a new set of recovery codes to save.

Turning it off

On Your profile, enter your password under Your password, to turn it off and click Turn off.

If your business requires two-step sign-in, there's no Turn off button.

Requiring it for everyone

The Owner and Admins can ask everyone on the team to use two-step sign-in.

1. Open Settings > Team.
2. Under Sign-in security, tick Everyone uses two-step sign-in.
3. Click Save.

Anyone who hasn't set it up is taken to their profile the next time they open a page, and can't carry on until they have. If you turn it on before setting up your own, you're taken there first.

The team list shows Two-step sign-in on or Password only under each person's name, so you can see who has set it up.

Resetting it for someone

If someone has lost their phone and their recovery codes, the Owner or an Admin can reset it:

1. Open Settings > Team.
2. Click Reset next to Two-step sign-in on under their name, and confirm.

They can then sign in with just their password and set it up again. If your business requires two-step sign-in, they're asked to do that straight away.

You can't reset your own this way. Only the Owner can reset the Owner's.