Two-factor authentication and passkeys
An email address is optional on your account.
- For you
- A confirmed address can reset your password.
- In your inbox
- Account and security emails arrive there.
The password is the only thing standing between someone and your account, so a second factor is worth the two minutes.
Authenticator app (TOTP)
Settings → Sign-in → Set up
-
01
Scan the QR code with any authenticator app.
-
02
Enter one code to confirm the clock agrees.
-
03
Save the recovery codes. They are shown once. Store them somewhere safe; you cannot view them again later.
- A recovery code
- Each one works once. A code you have used is spent.
- A login code
- A code you have used cannot be used to sign in again.
Passkeys
Settings → Sign-in → Add a passkey
Your device's own unlock (fingerprint, face, or PIN) becomes the login.
Nothing typeable is exchanged.
That is what makes a passkey resistant to phishing in a way a code is not.
Register more than one if you can: a laptop and a phone, say.
- Laptop
- Phone
A passkey lives on the device that made it, and a single passkey plus a lost device is a bad afternoon.
No SMS, no email
Neither is offered as a second factor. Someone who controls your phone number or mailbox could use it, so use an authenticator app or passkey for a second factor.
Account and security emails
Add an address under Settings → Account & Security and confirm it to receive password reset links and alerts about unfamiliar sign-ins.
Without a confirmed address, you cannot reset your password by email. Recovery codes help after you enter your password if you cannot use your second factor. A passkey can also sign you in independently.