Signing in, passwords and two-step login

Passwords

• At least 12 characters. A few unrelated words make a strong password that's easy to remember.
• Very common passwords, and passwords found in known data breaches, are refused.
• Forgot your password? Use Forgot password on the sign-in page; we email a reset link.
• Change it on Notifications & security under Password. You need your current password, every other device is signed out, and you get an email confirming the change.

Two-step login

Two-step login asks for a 6-digit code from an authenticator app on your phone (such as Google Authenticator, Microsoft Authenticator or 1Password) after your password. With it on, a stolen password alone shows nothing.

Owners and admins must use it. Everyone else can turn it on from Notifications & security.

To set it up:

1. 1Open Notifications & security, find Two-step login and start.
2. 2Scan the QR code with your authenticator app.
3. 3Type the 6-digit code it shows.
4. 4Save your 10 recovery codes (copy or download them). They're shown only once.

Recovery codes and a lost phone

Each recovery code works once, instead of the app's code.

1. 1On the code screen, choose to use a recovery code and type one.
2. 2You're signed in, and two-step login is turned off for your account.
3. 3Set it up again on your new phone straight away (owners and admins are taken there automatically).

You can make a fresh set of codes at any time from Notifications & security; the old ones stop working.

Staying safe

• After 10 wrong tries in 15 minutes, an account rests for 15 minutes. Wrong passwords are also slowed down after the third.
• You're signed out after 12 hours of inactivity, or 14 days after signing in.
• When you sign in from a new device, we email you, with a link to change your password if it wasn't you.
• Where you're signed in lists every device. Sign out one, every other device, or everywhere. A signed-out device loses access at once.
• Your recent activity lists your sign-ins and account changes.