A few minutes of setup makes your account much harder for anyone else to
get into. Everything below lives at
Profile → Security (/profile/security).
Two-factor authentication (2FA)
Add a second step to sign-in using an authenticator app (such as the
one on your phone). After your password, you enter a short code from the
app — so a stolen password alone isn't enough to get in.
- Open Profile → Security and choose Set up two-factor.
- Scan the code with your authenticator app.
- Enter the code it shows to confirm.
Passkeys
A passkey lets you sign in with your device's fingerprint, face, or
screen lock instead of typing a password — quick, and resistant to
phishing. Add one from the same Security page and follow your device's
prompt.
Hardware security keys
For the strongest protection you can register a hardware security key
(a physical key you tap or plug in). Add it under Security the same way
you add a passkey.
Recovery codes
When you turn on 2FA, generate a set of recovery codes and keep them
somewhere safe (a password manager, or printed). Each code works once and
lets you back into your account if you ever lose your phone or key. You
can regenerate the set at any time, which invalidates the old codes.