Two-step verification: protect your sign-in with a code

Two-step verification asks for a code from an authenticator app each time you sign in, as well as your password or Google. If someone learns your password, that alone won't get them into your account. It's optional, and it works on every plan.

Before you start

You need an authenticator app, such as Google Authenticator, 1Password or Authy. It makes a new 6-digit code every few moments. Tailored Folio doesn't send codes by text message or email.

Turning it on

1. Open your avatar menu, then Settings, then Sign-in & security.

2. Under Two-step verification, choose Turn on two-step verification.

3. Confirm it's you. Unless you signed in within the last few minutes, enter your Current password. If you sign in with Google or don't have a password, choose Sign in again instead. Then choose Continue.

4. Scan the QR code with your authenticator app, or type the Setup key into it.

5. Enter the 6-digit code the app shows and choose Turn on.

6. Save your 10 backup codes. Use Copy or Download, then choose I've saved them. We won't show them again.

The section now shows On, the date you turned it on, and how many backup codes you have left. We email you to confirm. If the page says the setup has expired, choose Turn on two-step verification and start again.

Backup codes

A backup code gets you in if you can't use your authenticator app. Keep them somewhere safe that isn't your phone, such as a password manager or a printed copy.

• Each code works once. A code has 10 characters, shown in two groups of five. Hyphens and capital letters don't matter when you type one.

• We email you each time one is used, and the email says how many you have left.

• When 2 or fewer are left, Sign-in & security warns you, and you're offered new ones right after you sign in with a backup code.

• Make new backup codes gives you a fresh set of 10. Your old codes stop working right away. You'll be asked to confirm it's you first.

Signing in with two-step on

Sign in as usual, with your password or Google. The Enter your code page then asks for the code from your app. Enter it and choose Continue. You'll see this page each time you sign in, on every browser and device. Nothing else in your account opens until a code has passed.

If you don't have your app, choose Use a backup code instead. If you've lost your phone, see Lost your phone? Getting back into your account.

Changing your password, your sign-in email or your two-step settings also asks for a code, unless you entered one in the last few minutes.

Wrong codes

After 5 wrong codes, of either kind, new tries pause for 15 minutes, and the page tells you when you can try again. Backup codes are paused too. We also email you, because this can mean someone else knows your password. If it wasn't you, change your password as soon as you can get in. See Changing or resetting your password.

If the page says it couldn't check your code right now, that try wasn't counted. Try again in a minute, or use a backup code.

Moving to a new phone

There's no separate step for this. While you still have your old phone, choose Turn off, then turn two-step back on with your new phone. You'll get 10 new backup codes.

Turning it off

Choose Turn off, confirm it's you, and choose Turn off two-step verification. This removes your authenticator and every backup code. Signing in then only needs your password or Google. We email you to confirm.

If you get an email saying two-step was turned on or off and it wasn't you, follow the steps in that email right away.