Two-factor authentication

Two-factor authentication (2FA) asks for a short code from your phone in addition to your password, so a stolen password alone is not enough to sign in. You turn it on for yourself on the Account security page, and your workspace can require it of everyone.

Enrolling

You will need an authenticator app such as 1Password, Google Authenticator, or Authy.

1. Open Account security and find the Two-factor authentication section.
2. Confirm your password, then select Set up two-factor.
3. Scan the QR code that appears with your authenticator app.
4. Save the one-time backup codes shown beneath it somewhere safe. Each code works once if you ever lose your device.
5. Enter the current 6-digit code from your app and select Verify and enable.

Once it is on, signing in will ask for a fresh 6-digit code after your password. To turn it off later, come back to the same section, enter your password, and select Turn off two-factor.

Keep your backup codes. They are the fallback for the times your authenticator app is not to hand, and each one can be used a single time.

When your workspace requires 2FA

An admin can require two-factor for everyone from Settings → Security, using the Require two-factor authentication (2FA) setting. When that is on, anyone who has not yet enrolled is sent to Account security to set it up before they can use the workspace. Nothing else in the app opens until 2FA is enabled, so enroll using the steps above and you will be let straight through. This is an account-level policy; who can change it is covered in roles and permissions.

If you sign in with Google and have no password

Two-factor uses your password as the fallback when your authenticator is unavailable, so you need a password before you can enroll. If your account was created with Google and has never had a password, setting up 2FA will fail the password check.

To fix this, set a password first:

1. On the Account security page, select Email me a set-password link.
2. Open the email we send and follow the link to choose a password.
3. Come back to Account security and enroll with the steps above.

You can also set a password from the Forgot password? link on the sign-in page. Either way, once a password exists you can enroll normally, and you can keep signing in with Google as usual.