Two-factor authentication and recovery codes

Two-factor authentication asks for a code from an authenticator app every time you sign in, on top of your password. To turn it on:

1. Open Account & security → Two-factor authentication and click Set up two-factor.
2. Scan the QR code with any authenticator app (1Password, Authy, Google Authenticator), or type in the key shown under it.
3. Enter the 6-digit code the app shows and your current password. If you signed up with Google and never set a password, a Google sign-in in the last 10 minutes stands in for it.
4. Save the recovery codes shown next.

Nothing changes until a valid code is entered: leaving the page leaves 2FA off.

How many recovery codes do I get?

Turning 2FA on shows ten single-use codes, in the form xxxx-xxxx-xxxx-xxxx, once. Each one signs you in once without your phone. The page shows how many are left, and Regenerate codes replaces the whole set (your password is asked for).

Signing in with 2FA on

• On the web, after your password, or after signing in with Google, you are asked for the authentication code. Lost your phone? Open Lost your phone? Use a recovery code under the code box.
• In the LineMerge phone app, the sign-in screen adds a 6-digit code or recovery code field after your password. Either kind of code works there.
• Turning 2FA off and deleting your account also ask for a current code or a recovery code, as well as your password.

Too many wrong codes: after five incorrect codes within 15 minutes, code entry is paused for 15 minutes, on the web and in the apps alike. Recovery codes count toward the same limit. Wait, then sign in again from the start.

What if I lose my phone?

Sign in with a recovery code, then turn two-factor off and set it up again on the new phone. If you have lost both the phone and the codes, email support from the address on your account.