# Account security (2FA)

Turn on two-step verification, keep backup codes, turn it off, and what to do if you lose the device.

Two-step verification (2FA) asks for a 6-digit code from an authenticator app each time you sign in. Open the Account page in the console, Security section.

## Turning on 2FA

1. Press Turn on 2FA. If your account has a password, enter it.
2. Scan the QR code with an authenticator app, or copy the secret shown.
3. Enter the 6-digit code from the app to confirm.
4. Keep the 10 backup codes shown. They show only once.

## Backup codes

A backup code can be used once instead of the 6-digit code. You can make 10 new codes at any time by entering a code from the app or one backup code; the old codes stop working at once.

## Turning off 2FA

Press Turn off 2FA and enter a 6-digit code or one backup code. Admin accounts cannot turn 2FA off.

## Lost device

If you lose the device and have no backup codes left, contact support (through the Support page in the console). An admin resets 2FA after checking your identity. After the reset you sign in with your password and can turn 2FA on again.

Too many wrong codes are answered with `too_many_attempts`; wait a little and try again.