Two-factor sign-in

Two-factor sign-in asks for a code from an authenticator app (such as Google Authenticator, 1Password or Authy) as well as your password, so a stolen password isn't enough to get in. Each person turns it on for their own account.

Turn it on#

1. Open the menu under your name and choose Account & notifications.
2. Under Two-factor sign-in, press Turn on.
3. Scan the QR code with your authenticator app. Can't scan it? Copy the key shown beside it and add it in the app instead.
4. Enter the 6-digit code the app shows and press Turn on.
5. Save the 10 recovery codes, then press I've saved them.

Recovery codes#

Recovery codes get you in if you lose your phone. Keep them somewhere safe, such as your password manager: they are shown only once. Each one works once, and the account page shows how many you have left.

To make a new set, enter a code from your app (or an unused recovery code) and press New recovery codes. The new set replaces the old one.

Signing in with two-factor#

After your password, or after Continue with Google or GitHub, enter the code your app shows. Codes change every 30 seconds, so use the newest one. Lost your phone? Press Lost your phone? Use a recovery code.

The comment tools on a review link ask for a code too when you sign in there.

Enter the code within 10 minutes of the first step, or start again. After 10 tries in 15 minutes you see "Too many attempts. Try again in 15 minutes."

Turn it off#

On Account & notifications, enter a code from your app (or a recovery code) and press Turn off.

Lost your phone and your recovery codes?#

Contact support and we can switch two-factor off for you after checking it is really you. Resetting your password does not turn it off.