Two-factor authentication (2FA)
Optional security upgrade — adds a 6-digit code from an authenticator app to your sign-in. Trusted devices skip the code prompt for 30 days, so it stays low-friction.
Set it up
Settings → Account → Two-factor authentication. Scan the QR code with 1Password / Authy / Apple Passwords / Google Authenticator, enter the 6-digit code, and save the 10 recovery codes somewhere safe.
Trust this device
On the next sign-in, leave 'Trust this device for 30 days' checked. You won't be prompted for the code again on that browser for 30 days unless you clear cookies, switch networks, or disable + re-enroll MFA.
Require it for your whole team
DSO owners can flip 'Require 2FA for the whole DSO' on the same settings page. Every team member is then forced to enroll at their next sign-in. Available on any paid tier.
Lost your device?
Use one of the 10 recovery codes from setup — each works once and reveals the option to re-enroll a fresh authenticator. If you've used them all, email support and we'll verify your identity to reset.