Turn on two-factor sign-in

How do I protect my account with two-factor authentication?

Under Security, turn on two-factor sign-in, scan the QR code with an authenticator app, confirm a code, and save your recovery codes somewhere safe.

Before you start: A phone with an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 2FAS or a password manager with one-time codes).

Step by step

1. Sign in and open Security from the account menu.
2. Under Two-factor sign-in, choose Turn on. A QR code appears.
3. In your authenticator app tap Add (+) and scan the QR code. If you cannot scan, choose "enter a setup key" in the app and type the key shown under the QR code.
4. Type the 6-digit code the app now shows into CoreX and confirm. Codes change every 30 seconds; if one is refused, wait for the next.
5. CoreX shows a set of recovery codes once. Download or write them down and keep them offline (not in the same phone). Each code works once if you lose your phone.
6. From now on, signing in asks for a code from the app after your password.

Check it worked: Security shows two-factor as On, and your next sign-in asks for a code.

Why it happens: A password alone can be phished or leaked; a second code from your phone stops someone who only has the password.

More guides on Account and login:

• Reset a forgotten password
• Verification code not arriving or rejected
• Sign in with Google, and set a password for SFTP
• Change your password or email address
• Lost your two-factor phone or codes keep failing
• Cannot sign in: attempts limit, security check or mobile