Turn on two-step sign-in

With two-step sign-in on, a password alone isn't enough to get into your account: signing in also asks for the six-digit code an app on your phone shows. It's optional, and you turn it on from the web.

A passkey already counts as both steps — the device and your fingerprint, face or PIN — so signing in with one never asks for a code.

Turn it on

1. Open Settings → Sign-in & security and find Two-step sign-in. It says Off. (In a phone's browser, Settings is under More.)

2. Enter Your password and choose Set up the authenticator app. If you sign in only with Google or Apple, it asks you to sign in with it again first, then set it up within 15 minutes.

   12

   12

3. Add Hand & Seal to an authenticator app on your phone. Open Google Authenticator, Microsoft Authenticator, 1Password or your phone's own passwords, add an account, and scan the QR code on the screen. Can't scan it? Choose Copy the key and type the key into the app instead. Setting up on the phone you're reading this on? Choose On this phone? Open it in your authenticator app.

4. Type the six-digit code the app shows, and choose Turn it on. The card says “Two-step sign-in is on.”

5. Keep your recovery codes. Ten codes are shown once, now. If your phone is ever lost, each one signs you in once in place of a code. Choose Copy them or Download, and keep them somewhere apart from your phone — a password manager, or on paper.

6. Sign your other devices out, if you like. Devices already signed in stay signed in. Choose Sign out everywhere else and each asks for the second step the next time. Then choose Done.

We don't picture the QR code: it's the key to your account's codes. Never share it, or your recovery codes, with anyone.

Signing in with it

Look after it

Once it's on, the card lists Authenticator app and Recovery codes, each with its own buttons. Each change asks for a current code from the app (or a recovery code).

• A new phone: choose New phone beside Authenticator app. Enter a code from the old phone, choose Move to the new phone, scan the new QR code with the new phone, and choose Move it. The old phone's codes stop working.
• Running out of recovery codes: the card says how many of the 10 are left. Make new ones gives you ten fresh codes; the old ones stop working.
• Turning it off: choose Turn off, then Turn off two-step sign-in. Your recovery codes go with it; your passkeys stay.