Two-step verification asks for a code from your phone each time you sign in, so your account stays yours even if your password leaks.
- Install an authenticator app, such as 1Password, Bitwarden, Google Authenticator or Authy.
- Open Security in your settings.
- Scan the code with the app, or type in the key by hand.
- Enter the 6-digit code the app shows and click Turn on.
- Save your recovery codes somewhere safe. They are shown only once.
To turn it off later, enter a current code on the same page.
Tip: keep your recovery codes in your password manager. Each one gets you in once if you ever lose your phone.