Two-factor authentication adds a second step when you sign in, so a stolen password is not enough on its own.
Why it matters here
Your account holds accessibility findings for your websites: a precise list of where each site fails. That is commercially sensitive, and on some plans it includes your invoices too. It is worth the extra few seconds.
The two methods
| Authenticator app | Email code | |
|---|---|---|
| How you get the code | An app on your phone generates one | We email you one |
| Works without signal | Yes | No |
| Setup effort | A minute, with a QR code | One click |
| Backup codes | Yes, 10 of them | No |
| Security | Stronger | Good, but only as strong as your email |
Which to choose
Use the authenticator app if you can. It is the stronger of the two, it works on a plane or with no signal, and it comes with backup codes so losing your phone is recoverable.
Email codes are a reasonable second choice, and much better than nothing. The caveat is that your account becomes exactly as secure as your email account, so if someone can read your inbox the second step does not help.
You can turn on both
If both are enabled you choose which to use each time you sign in. Some people keep email codes on as a fallback while relying on the app day to day.
Turning it on
From Profile. See Setting up an authenticator app or Email sign-in codes.
It protects your account, not your workspace
Two-factor authentication applies to your own sign in. It does not force it on your colleagues; each person turns it on for themselves. If you are an Owner or Admin, it is worth asking your team to do the same, particularly anyone who can see billing.