How do I set up two-factor authentication (MFA)?

**Settings → Security → Multi-factor authentication** offers two options:

- **Authenticator app (TOTP)**, scan a QR code with Google Authenticator, 1Password, Authy, etc. Six-digit codes rotate every 30 seconds.
- **WebAuthn / passkey**, use a hardware key (YubiKey) or your device's built-in biometrics (Face ID, Touch ID, Windows Hello).

WebAuthn is the most phishing-resistant option. You can enrol both and use whichever is convenient.

While you're there, print or download your **recovery codes**, you'll need them if you lose your second factor.