Sign-in and two-step

• You sign in with a code we email you. No password.
• Two-step sign-in is your choice, and we recommend it. Once it's on, you also type the 6-digit code from your authenticator app each time you sign in. Turn it on in Sign-in and security. A helper you invite turns it on before they start.
• When you turn on two-step, you get 8 recovery codes. Keep them in a password manager. Each works once, if you lose your phone.
• Sign-in and security in your office lists the browsers that are signed in. Sign out everywhere ends all of them at once.
• Big changes (connecting Stripe, export everything, erase, payouts, domains, who has access) need two-step sign-in, and ask for your app code again first. If it's off, the office helps you turn it on, then takes you straight back.

Lost your phone and your recovery codes? Write to a person (see "Talk to a person"). Nobody can switch off two-step sign-in or change your sign-in email just because someone asks: we check it is really you first, and that takes time on purpose.

An authenticator app makes the 6-digit codes on your phone. Any common one works, such as Google Authenticator, Microsoft Authenticator, or the one in your password manager.