Two-step sign-in

Two-step sign-in asks for a 6-digit code from an app on your phone after your password. Someone who learns your password still can't sign in without your phone. It's your choice: each person turns it on for their own account.

Microsoft Authenticator, Google Authenticator and 1Password all work.

Turn it on

1. Select your name at the top right, then My account.
2. Open the Sign-in and security tab.
3. Next to Two-step sign-in, select Turn on.
4. Scan the QR code with your authenticator app. If you can't scan it, type the key shown instead.
5. Type the 6-digit code the app shows, and your password.
6. Select Turn on.
7. Save the recovery codes that appear: copy, download or print them. Then select I've saved them.

Keep the recovery codes somewhere safe, away from your phone. Each one signs you in once if you lose your phone.

Signing in with it on

1. Sign in with your email and password as usual.
2. Open your authenticator app and type the code it shows for OnSite.
3. Select Verify and continue.

The code changes every 30 seconds. Any fresh one works.

Lost your phone

On the code page, select Lost your phone? Use a recovery code. Type one of your saved codes and select Use this code. Each code works once.

Once you're in, go to My account › Sign-in and security and set things up again on your new phone.

See or renew your recovery codes

1. Go to My account › Sign-in and security.
2. Next to Two-step sign-in, select Recovery codes.
3. Type your password or a code from your app, then select Show codes.

To get a fresh set, select Make new codes. The new set of 10 replaces the old one, and any you wrote down stop working.

Turn it off

1. Go to My account › Sign-in and security.
2. Next to Two-step sign-in, select Turn off.
3. Type your password or a code from your app. A recovery code works too.
4. Select Turn off.

Signing in then takes your password alone.