Two-factor authentication (2FA)

With two-factor authentication, signing in needs a six-digit code besides your password, generated afresh every 30 seconds by an authenticator app on your phone. Even if your password leaked, nobody could get into your account without your phone. We strongly recommend it to every customer.

Besides an authenticator app, you can also protect your account with a passkey or a security key; that is described in Setting up and using a passkey.

Turning it on

1. Install an authenticator app (TOTP), such as Google Authenticator, Microsoft Authenticator or Aegis.
2. In the portal, open the Security section of the Profile page and click Turn on the authenticator app.
3. Scan the QR code with the app. If you cannot scan it, type the secret shown below the QR code into the app by hand.
4. Enter the six-digit code shown in the app and click Activate.

From then on we ask for the code when you sign in, and when you change your password.

If you lose your phone

We do not issue recovery codes. If you lose your authenticator app, our support team turns off two-factor authentication once they have verified your identity, and you can then set it up again.

You can avoid this:

• use an authenticator app that makes an encrypted backup or syncs across devices,
• or, when setting it up, save the secret somewhere safe as well, in a password manager for example.

Turning it off

In the Security section, Disable 2FA turns it off; you need a current code from the app to do it.

If the code is not accepted

The code is based on the time, so your phone's clock must be set to update automatically. If the clock is off by as little as a minute, the codes will be rejected.