Skip to main content

Two-step verification

Two-step verification adds a second step when you sign in: after your password or Google sign-in, you enter a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in without your phone.

It works with any authenticator app, such as Google Authenticator, Microsoft Authenticator, 1Password, or Bitwarden.

Turn it on​

  1. Open Account settings from your profile menu and choose Security.
  2. Under Two-step verification, click Set up two-step verification.
  3. Scan the QR code with your authenticator app. If you can't scan it, click Can't scan it? Enter a setup key instead and type the key into the app.
  4. Enter the 6-digit code the app shows.
  5. Save your recovery codes: click Copy or Download and keep them somewhere safe, like a password manager. Check I've saved these codes and click Done.

Turning it on signs you out on your other devices. Sign in there again with a code.

Sign in with a code​

After your password or Google sign-in, enter the 6-digit code from your authenticator app. Codes change every 30 seconds, and each one works once.

Trusted devices​

On your own phone or computer, leave Don't ask again on this device for 30 days checked on the code screen. That device then signs in without a code for 30 days. Uncheck it on a shared computer.

To see or remove trusted devices, open Account settings > Security. Under Trusted devices, click Forget next to a device, or Forget all. Using Sign out of all devices or resetting your password also forgets every trusted device.

If someone else has your password​

If someone signs in with your password but enters wrong codes, two-step verification keeps them out and we email you. Change your password right away, then use Sign out of all devices in Account settings > Security.

Recovery codes​

Recovery codes get you in if you lose your phone. Each code works once.

  • To use one, click Can't use your app? Use a recovery code on the code screen.
  • To get a fresh set, open Account settings > Security and click Create new recovery codes. Your old codes stop working.

Lost your phone​

  1. Sign in with a recovery code.
  2. Open Account settings > Security and click Set up on a new phone. For 10 minutes after a recovery-code sign-in, this works without a code from your old phone.
  3. Scan the new QR code, enter the code your new app shows, and save your new recovery codes. Your old app and old recovery codes stop working.

If you have no recovery codes left and no access to your authenticator app, contact your administrator.

Organizations that require it​

An organization admin can require two-step verification for everyone in the organization.

  • If you haven't set it up, opening the organization asks you to set it up first. It takes about a minute.
  • If you have it on, you may be asked for a code before you continue, for example right after the requirement is turned on. Enter it and carry on: any edits you haven't saved yet are kept.
  • If the organization doesn't allow trusted devices, you're asked for a code every time you sign in.
  • A code counts for 30 days. After that, the organization asks for a fresh one, even if you stayed signed in.

Require it for your organization (admins)​

  1. Turn on two-step verification for your own account first.
  2. Open Settings under Administration in the sidebar.
  3. Under Security, turn on Require two-step verification. The confirmation shows how many members still need to set it up.
  4. Optional: turn off Allow trusted devices to ask for a code at every sign-in.

In Members & Groups, members who still need to set it up show Two-step not set up. The requirement applies right away, including to members who are signed in now.

API tokens used by other apps, such as QGIS, keep working: the requirement applies to people signing in.

Move to a new phone​

Still have your old phone? Open Account settings > Security, click Set up on a new phone, and follow the steps. At the end, confirm with a code from your old app or a recovery code. You're signed out on your other devices.

Turn it off​

Open Account settings > Security, click Turn off, and confirm with a code. If an organization you belong to requires two-step verification, you can't turn it off.