two-factor authentication ✧

a second lock on your account: signing in on a new device asks for a 6-digit code from an authenticator app on your phone, so a leaked password alone isn't enough ✦

1. 1
   get an authenticator app

   Google Authenticator, Authy, 1Password, Microsoft Authenticator, any of them works. if you already use one for other sites, use that.
2. 2
   turn it on

   Settings → security → two-factor authentication → set up. scan the QR code with the app (or type the key in by hand), then enter the 6-digit code it shows. if your account has a password, you confirm it here too.
3. 3
   save your recovery codes

   you get 10 recovery codes, shown once. copy them somewhere safe (a password manager is perfect). each one signs you in a single time if you ever lose your phone.

when you're asked. every way into your account goes through it: password, Discord, Steam and MyAnimeList. a browser you ticked trust this browser for 30 days on skips the code until then. the app code replaces the email code you used to get on new devices.

the code isn't right? codes change every 30 seconds and we accept one step either side, so a phone clock that's a little off is fine. a clock that's way off isn't: set it to update automatically, then try again. a code only works once.

lost your phone? on the sign-in step pick use a recovery code and enter one of the 10. then go to Settings → security, turn two-factor off and set it up again on your new phone.

running low on recovery codes? Settings → security → new recovery codes. the old ones stop working the moment the new ones appear.

turning it off takes a current app code (or a recovery code) plus your password, so someone who only has your open laptop can't remove it.

locked out with no codes? write to support from the sign-in page or at [email protected]. we'll check it's really you before we reset anything, so it can take a little while.