Turn on two-step verification
Last reviewed
Protect your account with a code from an authenticator app, and keep backup codes for a lost phone.
Two-step verification asks for a 6-digit code from an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy or similar) after you sign in, so a stolen password alone cannot open your account. It is off unless you turn it on, or your workspace Owner requires it.
Turn it on
- Open Settings → Security and choose Turn on. If you signed in a while ago, the app asks you to confirm it is you first.
- Scan the QR code with your authenticator app, or type the key shown under it.
- Enter the 6-digit code the app shows.
- Save your ten backup codes — copy them or download them — and keep them somewhere other than your phone. Each one gets you in once if your phone is lost.
Signing in with it
- After you sign in with your password, Google or Apple, enter the code your app shows. A code changes every 30 seconds and works once.
- Tick Trust this device for 30 days on your own phone or computer to skip the code there; never on a shared one.
- Five wrong codes in a row pause sign-in for 15 minutes.
- Settings → Security lets you make new backup codes (the old ones stop working), forget trusted devices, or turn it off with a code — unless your workspace requires it.
- Changing your password does not ask for a code again on the device you change it from.
Moving to a new phone
In Settings → Security choose Move to a new phone, enter a code from your old phone — or one of your backup codes if the old phone is gone — scan the new QR code with the new phone and enter its code. Codes from the old phone and your old backup codes stop working, and you get ten new backup codes. This works even when your workspace requires two-step verification.
Set your phone's time to update automatically. A clock that is a few minutes off makes every code look wrong.