Two-factor authentication and passkeys

There are two ways to protect your account better: ask for a 6-digit code from an authenticator app on top of your password (two-factor authentication), or use a passkey instead of a password. Signing in with Google or a passkey is already two-factor, so the code is only needed for password sign-in.

Turn on two-factor authentication

1. 1Open Settings → Account & security and expand Two-factor authentication.
2. 2Click Turn on.
3. 3Scan the QR code with your authenticator app (e.g. the iPhone Passwords app, Google Authenticator, Microsoft Authenticator, 1Password). On the same device you can use Open in authenticator app or the key after Manual key: instead.
4. 4Enter the 6-digit code the app shows now.
5. 5Click Confirm.

From then on, password sign-in also asks for the Authentication code. Each code works only once, and too many wrong codes lock sign-in for a while.

Turn it off

Enter a current code in the code field and click Turn off.

Add a passkey

1. 1On Account & security, expand Sign-in methods.
2. 2In the Passkeys – Touch ID / Face ID row, click the add button (on a Mac e.g. + Add Touch ID).
3. 3Confirm on your device with your fingerprint, face or Windows Hello.

The key stays on your device (or in iCloud Keychain); the server only stores its public part. Next time, use the passkey button on the sign-in page. Remove a passkey with Remove.