Two-step verification (Google Authenticator)

It's optional and free. When you log in, after your password (or Google or Facebook), we ask for the 6-digit code the app shows on your phone; it changes every 30 seconds.

• Turn it on: Settings → Turn on with Google Authenticator. Scan the QR code with the app (Microsoft Authenticator or Authy work too) and type the code it shows.
• Backup codes: when you turn it on we give you 10. Each one works once to log in if you don't have your phone. Keep them somewhere other than your phone: they're only shown once. In Settings you can request 10 new ones (the old ones stop working).
• Turning it off: in Settings, with a code from the app or a backup code. Turning it on or off always sends you an email.
• Changing your password doesn't turn it off: that way nobody can skip it by getting into your email.
• Lost your phone and your codes: message us on WhatsApp; we check it's you before removing it.
• If the app says the code isn't valid, make sure your phone's time is set to automatic.