Two-step and passkeys
Protect every account with a code from an authenticator app or a passkey, or let people sign in with Google or Microsoft. Administrators can require two-step for everyone.
What it does
More than a password
Authenticator codes
A 6-digit code from Google Authenticator, Microsoft Authenticator or 1Password, asked for after your password.
Passkeys
Sign in with Windows Hello, Face ID, a fingerprint or a security key. No password to type or leak.
Google or Microsoft
Continue with the account you already have. If you turned on two-step, its code is asked for after.
Recovery codes
Lost your phone? One of ten single-use recovery codes gets you in, and you can make new ones any time.
How it works
Set up in a minute
- 1
Open Security
In Settings › Account › Security, choose Set up beside Two-step verification, or Add a passkey.
- 2
Confirm it
Scan the QR code and type the 6-digit code, or approve the passkey with your face, fingerprint, PIN or key.
- 3
Keep a way back
Save your recovery codes, and add a passkey on each device you use, so losing one never locks you out.
Good to know
The details
- Who can use it
- Everyone, on their own account. Administrators can require two-step for every member, administrators included, in Settings › Details › Security.
- Sign-in rules
- That same tab chooses which sign-in methods are allowed, and ends idle sessions after 1, 7, 30 or 90 days.
- Passkeys and codes
- A passkey already counts as two steps, because it needs your device and you, so signing in with one asks for no code.
- Trusted browsers
- Leave Trust this browser for 30 days ticked on your own computer and it won’t ask again for a month.
Be one of the first teams in
We let a few organisations into the private beta every week. Join the waitlist and we’ll email you when there’s room for your team.
Three quick questions. No card needed.