Two-Factor Authentication

Two-factor authentication (2FA) adds a second step when you sign in: after your password you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get into your account.

Your account holds your identity verification and your takedown history, so we strongly recommend turning it on.

Turn it on

1. Install an authenticator app on your phone, for example Google Authenticator, Microsoft Authenticator or 1Password.
2. In the dashboard, open Account and go to Two-factor authentication.
3. Select Turn on two-factor authentication. For your security this needs a sign-in within the last 30 minutes; if you signed in earlier, sign out and in again first.
4. Scan the QR code with the app. Cannot scan? Type the key shown next to it into the app instead.
5. Enter the 6-digit code the app shows and select Turn on.
6. Save your 10 backup codes (copy them or download them as a text file) and confirm that you saved them.

We email you a security notice whenever 2FA is turned on or off.

Signing in

After your email address and password, enter the current code from your authenticator app. Codes change every 30 seconds; if a code is refused, wait for the next one and check that the time on your phone is set automatically.

After 5 wrong codes in 15 minutes the code step is locked for the rest of those 15 minutes.

Backup codes

Backup codes let you sign in when you do not have your phone. Each code works once.

• On the sign-in code step, choose Use a backup code instead and enter one of your codes (with or without the dashes).
• We email you when a backup code is used, with the number of codes you have left.
• The account page shows how many unused codes you have. Running low? Select Create new backup codes and enter a code from your app. Your old codes stop working straight away.

Keep your codes somewhere safe and private, for example in a password manager or printed in a drawer. We only show them once.

New phone or lost phone

You still have a backup code: sign in with it, then go to Account, Two-factor authentication, select Turn off and enter another backup code. Turn it on again with your new phone.

You have neither your phone nor a backup code: email [email protected] from the email address of your account. To protect your account we first confirm your identity (we compare it with your identity verification). After that we turn 2FA off for you and email you a security notice. Sign in with your password and turn it on again.

Turn it off

Go to Account, Two-factor authentication and select Turn off. For your security you need to have signed in within the last 30 minutes (otherwise sign out and in again first) and you enter a current code from your app or an unused backup code.

Good to know

• Some actions ask for the code step to be completed in your current session: submitting takedown requests, identity verification, billing changes and changing your login email.
• The "Turn on two-factor authentication" tip on your dashboard appears after you verify your identity or buy a plan. You can hide it; Show tips in Settings brings it back.