Two-factor authentication

Two-factor authentication (2FA) adds a second step when you sign in: after your password, you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in without the phone. It is strongly recommended for accounts that hold a balance.

What you need#

An authenticator app that supports time-based codes (TOTP), such as Google Authenticator, Authy or 1Password. Any TOTP app works.

Turn it on#

1. Open Settings in the dashboard and find Two-factor authentication.
2. Click Set up 2FA.
3. Scan the QR code with your authenticator app. If you cannot scan it, type the Manual setup key into the app instead.
4. Enter the 6-digit code the app shows in Verification code.
5. Click Verify & enable.

The section now shows 2FA as On.

Sign in with 2FA#

Enter your email or username and your password as usual. You are then asked for the current code from your authenticator app. Codes change every 30 seconds, so type the one on screen right away.

If codes are always rejected, check that the time on your phone is set automatically. Authenticator codes depend on the clock.

Turn it off#

1. Open Settings and click Disable 2FA.
2. Confirm with your account password. You can also enter a current code.
3. Confirm. The account is protected by the password alone from then on.

Lost your phone#

Without the authenticator app or the setup key you cannot produce codes. Contact support in live chat, or email [email protected] from the address on the account, and the team will help you after checking that the account is yours.

More account security#

• Use a password you do not use anywhere else.
• Keep the email account secure, because password resets go there.
• Treat proxy passwords like API keys and change them if they leak, see Authentication.