Two-step sign-in, recovery codes and trusted devices
How the six-digit code, the 10 recovery codes, remembered devices and sign-in sessions work together to protect your account.
Two-step sign-in adds a second lock to your account: after the password, you type a six-digit code that only your phone can show. A stolen password alone is no longer enough to see your customers' passports and payments.
The code from your phone
An authenticator app (Google Authenticator, Microsoft Authenticator, Authy or 1Password) shows a new six-digit code every 30 seconds. The app and the system both work the code out from a secret shared once, when you scanned the QR code, and from the time. That is why the phone's clock must be right. The phone does not need the internet.
After 5 wrong codes in a row, the system stops checking codes for that account for 15 minutes.
Recovery codes
When you turn two-step sign-in on, you get 10 recovery codes such as K7QX5-M2PL9. Each one replaces the phone
once. They are shown only once, so print them or keep them in a password manager, away from the phone. You can
make a fresh set at any time in My account; the old set then stops working.
Remembered devices
On a computer you trust, tick Remember this device for 30 days when you type the code. That browser skips the code step for 30 days. Never tick it on a shared or public computer. You see and remove remembered devices in My account under Remembered devices.
Sessions
Each sign-in creates a session on that device. It lasts 14 days, or until you sign out. Where you are signed in in My account lists them, and you can end any of them. Changing or resetting your password ends all sessions on your other devices.
Who decides whether it is required
- You: anyone can turn it on in My account.
- Your agency: the owner can require it for everyone, for some roles, or for one person, in Settings → Sign-in security.
- The platform: can require it for your agency or for every agency.
When it is required, you set it up at your next sign-in before you can work (see When you must set up two-step sign-in first), and you cannot turn it off.
When the phone is lost
Use a recovery code. If you have none left, your agency owner (or a colleague whose role manages the team) can reset your two-step sign-in: your codes and remembered devices are removed, you are signed out everywhere, and you set it up again on the new phone. See I lost the phone with my authenticator app.
Related articles
- Set up two-step sign-inProtect your account with a six-digit code from an authenticator app on your phone, and save your 10 recovery codes.
- Recovery codes, a new phone and turning two-step offUse a recovery code when your phone is not with you, make a fresh set of 10, move two-step sign-in to a new phone, or turn it off.
- Sign out other devices and forget remembered devicesSee every device signed in with your account, sign out the ones you do not use, and forget browsers that skip the code.
- When you must set up two-step sign-in firstWhy the system asks you to protect your account before you can work, and how to finish the setup in about a minute.