Help / Security and privacy

Trusted devices and recovery codes

Remember a browser for 30 days, and use single-use recovery codes if you lose your second step.

Recovery codes

When you turn on your first two-factor method, you get ten recovery codes. Each code works one time. They are your way back in if you lose your phone or cannot get email.

They are shown once. Copy or print them and keep them somewhere safe, away from your password.
We keep only a scrambled form of the codes, so we cannot show them to you again.
On the Security page you can see how many are left. Press Make new codes to replace the whole set. The old codes stop working.
Never give a recovery code to anyone, including support. Do not type one into a chat.

At the login second step, use a recovery code in place of a normal code.

Trusted devices

If you tick remember this device at login, that browser is trusted for 30 days and is not asked for a second step. The Security page lists your trusted devices with when each was last used and when it expires. You can remove one, or remove them all.

Trusted devices are removed for you when:

you change or reset your password,
your account is suspended,
you turn off a two-factor method,
an administrator resets your two-factor settings.

Only trust a device that is yours and is protected by its own lock.

If you lose everything

If you have no recovery code, no authenticator app, no working email and no trusted device, an administrator must reset your two-factor settings. See the troubleshooting guide on being locked out.