Turn on two-factor authentication
Add a one-time code from an authenticator app to every sign-in with your password.
Who can do this: everyone, for their own login. It matters most for admins and account Owners, who control access and billing.
Before you start, install an authenticator app that supports time-based codes (TOTP) on your phone, and decide where you will keep your recovery codes. Do not keep them on the same phone.
Open Password & sign-in
Open Settings, choose the You tab, then Password & sign-in. Confirm your password if you are asked.
Start the setup
Under Two-factor authentication, in the Authenticator app row, select Enable 2FA.
Pair your app
Scan the QR code with your authenticator app, or enter the setup key shown under "or, enter the code manually". Select Continue.
Enter a code
Type the 6-digit code your app shows, then select Continue.
Save your recovery codes
Under 2FA recovery codes, select View recovery codes and store them somewhere safe, such as a password manager.
What happens next
The Authenticator app row shows Enabled. From now on, signing in with your password also asks for a code from your app.
Recovery codes let you get back in if you lose the phone. Each code works once. To replace them, select Regenerate codes: "The recovery codes you have now stop working immediately, including any you printed or saved."
If you closed the setup before entering a code, the row offers Continue setup so you can finish with the code you already scanned.
Turn two-factor off
Select Disable 2FA. The confirmation explains that signing in with your password will no longer ask for a code and that your recovery codes stop working. It also names any workspace that requires two-factor and would stop opening for you, unless you still hold a passkey, which counts as a second factor. Select Turn off two-factor to confirm.
If it doesn't work
- The code is rejected: check that your phone sets its clock automatically. Time-based codes fail when the clock drifts.
- You lost the phone: on the code screen when you sign in, choose log in using a recovery code and enter one of your codes. Then set up two-factor again on the new phone.
- You lost both the phone and the recovery codes: contact support. See Get help.