Two-step sign-in

Turn on a code from your phone as well as your password, and keep recovery codes in case you lose it.

Updated

Two-step sign-in adds a second check when you sign in: a 6-digit code from an app on your phone as well as your password. Your account holds your guests’ details and your bookings, so a stolen password on its own shouldn’t be enough to get in.

What you need

An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or the one built into your password manager. It makes a new 6-digit code every 30 seconds.

Turning it on

  1. Go to Two-step sign-in. You’ll find it in the menu under your name (on a phone, under More), or in Settings › Your account if you can open Settings.
  2. Type your password if asked. This keeps your account safe if someone else is at your computer.
  3. Tap Turn on two-step sign-in.
  4. Scan the QR code with your authenticator app, or type in the setup key. Tap Carry on.
  5. Type the 6-digit code your app shows, to check it works.

It now says Switched on.

Recovery codes

If you lose your phone, a recovery code lets you sign in. Tap Show recovery codes and keep them somewhere safe, like a password manager. Each code works once. If you run low, tap Make new codes.

Signing in

After your email and password, you’ll be asked for the 6-digit code from your app. If you don’t have your phone, tap log in with a recovery code instead and type one of your recovery codes.

The reminder on Today

Once your site is live, Today shows Turn on two-step sign-in until you do. Tap Turn it on, or Remind me in 30 days to hide it for a month. It’s for whoever is signed in, so each member of your team sees their own reminder.

Turning it off

Go to Two-step sign-in and tap Turn off two-step sign-in. You’ll only need your password to sign in again.

Good to know

  • Two-step sign-in belongs to your own account, not your site. Each person on your team turns it on for themselves. See Your team and what they can do.
  • Finish setting up in one go. If you stop part-way, Carry on setting up picks up where you left off, but only until you leave or reload the page. After that you’ll get a new key, so delete the one you scanned from your app and scan the new one.