Two-Step Sign-In and Passkeys

Ask for a second step after your password: a 6-digit code from an authenticator app, or a passkey kept by your phone, computer, password manager or security key. Someone who learns your password still cannot sign in.

Where to find it

• The account button (your initials) at the right of the top bar → Account Settings → Two-step sign-in.

Main actions

• Authenticator app: Set Up Authenticator App…, enter your password, scan the QR code with the app (or type the key), then enter the code it shows and choose Turn On.
• Passkey: Add a Passkey…, enter your password, then confirm in the browser with your fingerprint, face or screen lock. A passkey also signs you in without an email address or password (Sign In with a Passkey).
• Recovery codes: 10 single-use codes, shown once when two-step sign-in turns on. Download or copy them and keep them apart from your phone. Create New Codes… replaces the set.
• Turning it on signs out your other devices. Every change is emailed to you.
• Turning it off: Turn Off… (password and a code) for the app, Remove for a passkey. Removing the last one turns two-step sign-in off and deletes the recovery codes.
• Lost your phone or passkey: sign in with a recovery code. Without one, ask the site administrator to reset two-step sign-in, then set it up again.

Tips

• Google and Microsoft sign-in count as the first step only.
• An organization can require two-step sign-in for its projects; Holarch then asks you to set it up when you sign in.
• Accounts without a password (Google or Microsoft only) make these changes within 10 minutes of signing in.

Related

Your Account · Signing In · Organization Settings