# Two-factor authentication


> An authenticator app code on top of your usual sign-in, with backup codes, for organizations whose policy requires it.
Two-factor adds an authenticator app code on top of whichever method you sign in with. It is off by default and not required.

## Whether you need it

Think about what it adds on top of what you already have.

**On a one-time email code**, it adds a real second factor: somebody with your mailbox alone cannot get in.

**On a passkey**, it adds much less. A passkey is already something you have plus something you are, and it cannot be phished. Turning on two-factor here mostly adds friction.

**With SAML single sign-on**, do it at the identity provider instead. That is the whole point of SSO: one policy, applied everywhere, rather than per application.

So the honest answer is that it earns its place for organizations with a policy requiring it, and for anyone whose main route in is an email code.

## Setting it up

From your **account settings**, under **Security**, in the two-factor section. Scan the QR code with your authenticator app, enter the code it generates, and save.

You are then given **backup codes**. Store them somewhere that is not the phone holding the authenticator, because the situation they exist for is that phone being lost.

## Signing in with it

Your usual method, then the code from the app. A backup code goes in the same field.

## Turning it off

Disabling asks for a code emailed to you **and** a code from the authenticator. Both, deliberately: turning off a second factor should be at least as hard as using it.

## If you lose the authenticator

Use a backup code, sign in, and set it up again on the new device.

With no backup codes and no authenticator, this becomes an account recovery matter. See [Support PIN and account recovery](/docs/account/support/support-and-recovery/).