Two-factor authentication

Two-factor authentication adds a second step to signing in: a 6-digit code from an authenticator app on your phone. Turn it on under Two-Factor Authentication in Security. You also get 10 backup codes for the day you lose the phone.

Before you turn it on

• Install an authenticator app, such as Google Authenticator, Microsoft Authenticator or Authy.
• Have somewhere safe to keep 10 backup codes, away from the phone.

How to turn it on

1. 1.

   Open Settings → Security and choose Enable 2FA, then Get started.

2. 2.

   Scan the QR code with your app, or type the code under Or enter this code manually:. The app lists it as ACADA with your email address.

3. 3.

   Save the codes under Save your backup codes, for example with Copy all codes, and choose I've saved my codes.

4. 4.

   Type the 6-digit code your app shows into Verification code and choose Enable 2FA. The screen reads 2FA is enabled.

What happens next

We email you that two-factor authentication is on. From now on, every sign-in asks for a code after your password, including Google and GitHub sign-ins. A device that was already signed in asks for one the next time it opens a page.

The code goes into Verify it's you, which asks for the 6 digits your app shows. Codes change every 30 seconds, the one before or after also works, and each works once. Without the phone, choose Use a backup code instead: see Backup codes.

How to turn it off

1. 1.

   Choose Disable under Two-Factor Authentication.

2. 2.

   Enter your password in Disable two-factor authentication and choose Disable 2FA.

We email you that it is off, and signing in takes your password only. Your secret and backup codes are deleted, so turning it on again starts with a new QR code and new codes.

Rules and limits

• After 5 wrong codes, backup codes included, code checks stop for 15 minutes. After 15 wrong codes in a day, they stop for 24 hours.
• Turning it off needs your password. An account made with Google or GitHub sets one first with Forgot password on the sign-in page.
• To move to a new phone, turn it off and on again, and scan the new QR code.

If something goes wrong

"Please enter a 6-digit code"

Type all 6 digits from the app.

"Invalid code. Please try again."

The code was mistyped or had changed. Make sure your phone's clock is set automatically, then type the current code.

"Too many failed attempts. Please try again in 15 minutes. After 15 wrong codes in a day, checks stop for 24 hours."

Wait 15 minutes. Wrong backup codes count towards the same limit. If it is the 24-hour stop and you need in sooner, contact support from the email address on your account.

"Two-factor authentication is already on. Turn it off first to set it up again."

It is on already. Turn it off first if you are moving to a new phone.

"Too many verification attempts. Wait a few minutes and try again."

Setting up, confirming and turning off share a limit of 10 tries in 5 minutes.

"Incorrect password."

The password for turning it off was wrong.

You lost the phone and the codes

Contact support from the email address on your account.