Turn on two-step sign-in

Updated 2 November 2026

Two-step sign-in asks for a six-digit code from an authenticator app on your phone after your password, or after Google, Discord or Telegram. Someone who learns your password still can't get in without your phone.

Turn it on

1. Open Sign-in and security and find Two-step sign-in.
2. Beside Authenticator app, choose Turn on.
3. Enter your password and choose Continue. An account without a password can do this within 30 minutes of signing in; if it asks, sign out and sign in again first.
4. In your authenticator app, add an account and scan the QR code. If you can't scan it, type the key shown beside it.
5. Enter the six-digit code the app shows and choose Turn on.
6. Save your 10 recovery codes with Copy or Download, then choose I saved them.

Any authenticator app works, such as Google Authenticator, Microsoft Authenticator or 1Password.

Turning it on signs you out on every other device; each one signs in again with a code. We email you that it is on.

Signing in with it on

After your password, Google, Discord, Telegram or a password reset link, Glored asks for a code. Enter the newest one from your app.

• Each code works once. If one was just used, wait for the next.
• The code step stays open for 10 minutes. After 5 wrong codes, sign in again from the start.
• If every code is refused, check that your phone shows the right time.

Recovery codes

A recovery code works once, in place of a code from your app, if you lose your phone. Codes look like ABCDE-FGHJK. We show them only once, so keep them somewhere safe, away from your phone.

To use one, choose Lost your phone? Use a recovery code on the code step. We email you when a recovery code is used to sign in.

Sign-in and security shows how many you have left, such as "7 of 10 left".

Make new codes

Choose New codes, enter a code from your app and choose Make new codes. You get 10 new codes and the old ones stop working. This needs your app: a recovery code is not accepted here. We email you about it.

Turn it off

1. On Sign-in and security, choose Turn off beside Authenticator app.
2. Enter your password, if your account has one. Without a password, this works within 30 minutes of signing in.
3. Enter a code from your app, or choose Lost your phone? Use a recovery code.
4. Choose Turn off.

Your recovery codes are deleted, and signing in asks only for your password or provider again. We email you that it is off.

Turning it on or off and making new codes allow 10 attempts per account in 15 minutes.

Glored staff never ask for your codes or recovery codes. Anyone who does is not Glored.