How your account is protected
In short
Your account is protected by how you sign in, an optional second factor, and extra checks before sensitive actions. You can review all of it in Security settings.
Signing in
Sign-in is passwordless: you receive a one-time code by email rather than keeping a password that can be reused or leaked. There is no password to steal, guess or reuse from another site — which is where most account compromises actually begin.
The trade-off is that your email account becomes the key to this one. Securing your email with its own strong protection is the single highest-value thing you can do for this account.
Passkeys
A passkey ties sign-in to a device you already unlock — with a fingerprint, a face, or a device PIN. The secret never leaves your device and there is nothing transferable for a phishing site to capture.
Passkeys are added in Security settings. You can register more than one, and having a second is worth doing: it is what stops a lost phone from becoming a lockout.
Step-up checks
Some actions ask you to confirm who you are again even though you are already signed in — changing security settings, or acting on sensitive data.
This exists because the realistic threat is not someone breaking your sign-in, it is someone reaching an already-unlocked session on a device you walked away from. A step-up check limits what that person can do.
Recovery codes
Recovery codes are single-use fallbacks for when you cannot use your normal method. Each one works once.
Store them somewhere that does not depend on the account they recover — not in the email inbox you sign in with, and not only on the phone you would be trying to replace. A printed copy is genuinely reasonable here.
Common questions
- I lost my phone. Can I still get in?
- Yes, if you set up either a second passkey or recovery codes beforehand. Both are in Security settings, and both need to be arranged before you need them.
- Do I need both a passkey and two-factor?
- A passkey already proves possession of a device you unlocked, so it covers most of what a second factor adds. Having a recovery path matters more than stacking methods.