Password and two-factor authentication

Turn on two-factor

1. Open Settings → Account → Two-factor authentication.
2. Enter your password.
3. Scan the QR code with an authenticator app such as Google Authenticator, Authy or 1Password.
4. Save the backup codes somewhere safe. Each works once if you lose your phone.
5. Enter the six-digit code from the app to confirm.

From then on, signing in with your password asks for a code. Google and magic-link sign-ins are covered by those providers' own protections.

Lost your phone?

Use one of your backup codes at the code prompt, then turn two-factor off and on again with the new device. If you have no backup codes, email support from the account's email address and we will verify you another way.

Turn it off

Same place in settings; you will need your password.

Passwords

• Minimum 8 characters. Longer is better than complicated.
• Resetting your password signs you out everywhere, including the mobile app.
• If you signed up with Google there is no password to reset; use Google's account recovery.

Sessions and connected apps

AI agents you connected have their own access, separate from your password. Review and disconnect them under Settings → AI agents. See Connect AI agents.