Turn on two-factor authentication

Two-factor authentication adds a six-digit code to your sign-in. The code comes from an authenticator app on your phone or computer, and changes every thirty seconds.

Setting it up

1. Open your account page and find Two-factor authentication.
2. Choose Set up two-factor authentication. A QR code appears, with the secret printed underneath it for apps that cannot scan.
3. Scan or type it into your authenticator app.
4. Enter the six-digit code it shows and choose Confirm.
5. Ten recovery codes are shown. This is the only time they are shown — see Recovery codes.

Any app implementing TOTP works: 1Password, Bitwarden, Aegis, Raivo, Google Authenticator and the rest. There is no SMS option, and there is not going to be one — a code sent to a phone number is a code anyone who can move that number can read.

After it is on

The account page shows that it is on and how many recovery codes are left. Signing in then asks for a code after your password, and you can choose a recovery code instead of the app on that screen.

New recovery codes generates a fresh ten and invalidates the old set. Turn off removes the second step entirely.

What it protects today

The second step guards your account page and the change-password screen. The AI workspace at /ai is not behind it: that part of the app is built to run with no account at all, so a browser holding a valid session reaches it without passing the code screen.

That is worth knowing rather than assuming. It means two-factor protects the things that change your account — your password, your devices, your data export, deletion — and does not currently stand between a stolen session and your chats. Those chats are in the browser anyway, not on our servers, so someone with your session on their own machine does not see them.

If you lose the authenticator

Use a recovery code. If you have lost both the app and the codes, nobody can recover them for you — codes are stored only as hashes, so there is nothing to read back. Write to us from the address on the account and we will work out what can be done.

Before you travel, or before you reset a phone, check the account page for how many recovery codes you have left and generate a new set if the answer is low.