AccountSecurity & privacy
Turn on two-factor authentication (2FA)
Last updated Oct 5, 2026
Protect sign-in with an authenticator app: scan the code, enter a 6-digit code, and turn it on.
Two-factor authentication (2FA) adds a second step at sign-in, protecting your account even if someone learns your master password. Secure Passwords uses an authenticator app (TOTP); once 2FA is on, you can also add a security key (such as a YubiKey) under Security keys.
- In the web vault, open Settings, then 2FA, and select Turn on 2FA.
- Scan the QR code with Google Authenticator, Authy, 1Password, or any TOTP app — or enter the setup key by hand — and select Continue.
- Enter the 6-digit code from your app and select Continue, then confirm your master password and select Verify and turn on.
- Save your 10 backup codes when they're shown, then select I've saved these (see the next article).
Tip
Turning 2FA on or off signs you out of your other devices and sessions. To turn it off, open Settings, then 2FA, select Turn off 2FA, confirm your master password and a code from your app (or a backup code, or your security key), and select Turn off 2FA. This also removes any security keys. Under Backup codes, Create new codes replaces the old set.