Two-factor authentication (often called 2FA) adds a second step when you sign in. After your password, the site asks for a 6-digit code from an authenticator app on your phone. The code changes every 30 seconds, so even someone who learns your password can’t get in without your phone. It’s free and optional.
Turning it on
Install an authenticator app on your phone if you don’t have one. Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden all work.
Open Settings from the menu under your avatar, and click “Set up two-factor authentication”.
Scan the QR code on the screen with your app, or type in the key shown under it.
Enter the 6-digit code your app shows, plus your password, to finish.
We’ll send you an email to confirm it’s on.
Backup codes
When you turn on 2FA, you get ten backup codes. Each one works once, in place of a code from your app, if your phone is lost, broken or just not nearby. Save them somewhere safe, like a password manager or a printed copy. They’re shown only once, but you can make a new set any time on the two-factor page, which stops the old ones from working.
Signing in
After your password, enter the code your app shows. On your own computer or phone, you can tick “Don’t ask for a code on this device”, and that device won’t ask again for 90 days. Don’t tick it on a shared or public computer.
Every device asks for a code again after you sign out of your other devices from Settings, change your password or reset it.
If you lose your phone
Sign in with one of your backup codes. Then turn 2FA off and set it up again with your new phone. If you’ve lost your backup codes too, contact site staff from the email address on your account. We’ll turn 2FA off for you once we’re sure the request is yours.
Turning it off
On the two-factor page, choose “Turn off two-factor authentication”, then enter your password plus a code from your app or a backup code.