Two-factor authentication

Two-factor authentication adds a second step to signing in. Even if someone learns your password, they cannot get in without a code from your device. It is optional.

What you need

An authenticator app on your phone, such as Google Authenticator or Authy. The app shows a 6-digit code that changes every 30 seconds.

Turn it on

1. Choose Settings in the user menu and go to the Security tab.
2. In the Two-factor authentication card, choose Enable two-factor authentication.
3. If your account has a password, enter it and choose Continue. Accounts without a password, which sign in only with Discord or Google, skip this step.
4. Scan the QR code with your authenticator app. If you cannot scan it, enter the key shown under "Can't scan?".
5. Enter the 6-digit code from the app and choose Confirm.
6. Save your recovery codes, then choose I saved these codes.

We email you whenever two-factor is turned on or off, so you notice if someone else does it.

Recovery codes

You get ten recovery codes. Each one works once and looks like xxxxx-xxxxx.

• They are shown only once. Use Copy all or Download .txt and keep them somewhere safe, away from your phone.
• The card shows how many you have left. When 3 or fewer remain, it suggests regenerating them.
• To get a fresh set, choose Regenerate recovery codes, enter a code from your app or a recovery code, and choose Regenerate. The old set stops working.

Log in with two-factor

1. Log in with your email and password, or with Discord or Google. Signing in with Discord or Google also asks for a code.
2. Enter the 6-digit code from your authenticator app.
3. To use a recovery code instead, choose Use a recovery code.

Some limits apply:

• Your sign-in must be completed within 5 minutes of entering your password.
• After 5 wrong codes, that sign-in attempt is cancelled and you must start again.
• One account can try at most 5 codes in 15 minutes, right or wrong, across all sign-in attempts. If you hit this, wait and try again.
• A code can be used once. If you just used one, wait for the next code to appear.

Turn it off

In the Two-factor authentication card, choose Disable, enter a code from your app or a recovery code, and choose Disable again.

If you lose your device

• If you have recovery codes, use one to log in, turn two-factor off or regenerate codes, and set it up again on your new device.
• If you have neither your device nor your codes, email [email protected] from the address on your account. Support will confirm who you are before turning two-factor off. See Contact support.

Related: Email, password and sessions.