Turning on two-step verification

Turning on two-step verification · Help

If you want your account to hold even when your password is stolen, two-step verification is the most effective route: at sign-in it asks for the 6-digit code from an app on your phone in addition to your password. This guide walks through the setup, explains why the backup codes matter, and shows what to do when you change phones.

💡 Two-step verification is not compulsory, but without it the panel's sensitive screens are closed to you: Connection settings, moving an account, deleting an account and deleting a portfolio all require a security method. The alternative is a passkey; see Passkeys.

Get an authenticator app first

Two-step verification needs an authenticator app running on your phone. The app generates a new 6-digit code every 30 seconds and needs no internet connection.

Common ones: Google Authenticator, Microsoft Authenticator, 1Password, Authy. It doesn't matter which you use; they all follow the same standard. If you use a password manager (such as 1Password), keeping the codes there is the most practical.

Don't start the steps below before installing the app; the setup screen will leave you stranded.

The steps to turn it on

Click your user card at the bottom left and pick Security.
Find the Two-step verification section. A Off badge sits next to the heading.
Click Turn on.
The panel asks for your password: Enter your password to continue. Type it and continue.
A square code appears on screen with the note: "Scan this code with your authenticator app (Google Authenticator, 1Password…), then type the 6-digit code from the app."
Open the app on your phone, use its add-account option, and scan the code on screen with the camera.
The app adds the account and immediately starts showing a 6-digit code. Type it into the 6-digit code field.
Click Verify and turn on.

A "Two-step verification enabled." notice appears and the badge in the heading turns On.

If you can't scan the code

Scanning doesn't work on every device, and it's awkward if you're on a computer without your phone in hand. There is a way out under the square code: "If you can't scan the code, enter this key into the app manually:" followed by a key in text form.

Find the "enter setup key manually" option in the app and paste that text. The result is the same.

Backup codes

Once verification succeeds, the panel gives you a list of backup codes. The note is clear: "If you can't reach your phone you can sign in with these codes. Keep them somewhere safe; they are never shown again."

Don't skip this step. If you lose, wipe or have your phone stolen, your authenticator app goes with it; the backup codes are your only way into your account.

Practical advice on where to keep them:

Add them as a note in your password manager (1Password, Bitwarden and so on).
Print them and keep them in your wallet or a drawer.
Don't keep them as a screenshot on the same phone; if the phone goes, so do the codes.
Don't e-mail them to yourself; if your e-mail is compromised, the protection means nothing.

Each code works once. If you've used most of them, or you doubt their secrecy, you can generate new ones: press Generate new backup codes in the Backup codes section. As the note warns: "Generating new codes invalidates the old ones." Store the new ones with the same care.

At your next sign-in the panel asks for your e-mail and password, then the 6-digit code. You can type two things into the code field:

Your app's current 6-digit code.
A backup code (in the form abcde-12345).

The panel tells from the format which you typed; you don't have to say.

The same field turns up on sensitive screens inside the panel. Entering Connection settings, moving an account or deleting one asks for the same code. See The security verification screen.

When you change phones

If you moved to a new phone and can no longer reach the app on the old one, use Reset and set up again.

The section's description: "If you changed phones: the current setup is removed and you're asked to set it up with the new app straight away."

The steps:

Find the Reset and set up again section on the Security screen.
Click Reset.
The panel removes the current setup and reopens the setup screen.
Scan the code with the app on your new phone and enter the 6-digit code.

⚠️ Resetting only helps while you can still reach the old phone or have a backup code, because you have to be signed in to start. If you lost both your phone and your backup codes, contact our support team.

Turning it off

The Turn off section states the consequence: "Two-step verification is switched off; sign-in is by password alone."

Think about two things before you do:

If you have no other method (no passkey either), Connection settings, moving an account, deleting an account and deleting a portfolio all close to you.
Your account becomes protected by a password alone.

If you are thinking of turning it off because you changed phones, don't; Reset and set up again exists for exactly that.

Common mistakes

Moving on without saving the backup codes. They are never shown again, and they are your only way out if the phone is lost.

Pressing "Turn on" before installing the app. You'll sit on the setup screen with nothing to scan the code with and abandon the process.

Typing the code with a space. The app shows it as 123 456 but the field takes it without the space.

Typing an expired code. The code refreshes every 30 seconds. If it expires while you type, wait for the next one.

A phone clock that has drifted. Authenticator apps generate codes from the device clock. If codes keep being rejected, set your phone's clock to automatic.

E-mailing the backup codes to yourself. If your e-mail is compromised, the protection means nothing.

Trying to turn it off and back on after changing phones. Turning it off also requires signing in; the right route is resetting.

If it still doesn't work after all these steps

If your codes are rejected and you can reach neither your phone nor your backup codes, there is nothing left to do in the panel. Contact our support team.

For code-free sign-in see Passkeys, for the whole Security screen see Account security, and for where the code is demanded inside the panel see The security verification screen.