However strong your password is, it can still leak in a data breach or get typed into the wrong site. Two-factor authentication adds a second lock to your account: when you sign in, you enter your password plus a 6-digit code from the authenticator app on your phone. The code changes every 30 seconds, so even someone who knows your password can't get in without your phone. In Settings it's called Two-Factor Authentication (2FA), and you can turn it on with any plan.
1
Start the setup
Setup takes just a few steps. Open Settings and choose Security under the Account group in the list on the left. The Two-Factor Authentication (2FA) section sits right below the password section; if you haven't turned it on yet, it says 2FA Off.
If you don't have an authenticator app on your phone yet, install one first; you'll use it to scan a QR code in the next step. When you're ready, click Start Setup.
If you don't have an authenticator app on your phone yet, install one first; you'll use it to scan a QR code in the next step. When you're ready, click Start Setup.
Two-Factor Authentication (2FA)
2FA Off
Enable two-factor authentication to secure your account
Settings › Security · Two-Factor Authentication (2FA)
2
Scan the QR code and enter the code
When you click Start Setup, a QR code appears on screen. Open the authenticator app on your phone, add a new account, and scan the QR code. If you prefer, you can type the Manual entry key shown below the QR code into the app instead.
As soon as the account is added, the app starts showing a 6-digit code that refreshes every 30 seconds. Type the current code into the 6-Digit Code field and click Verify and Enable.
As soon as the account is added, the app starts showing a 6-digit code that refreshes every 30 seconds. Type the current code into the 6-Digit Code field and click Verify and Enable.
Two-Factor Authentication (2FA)
Scan QR Code with your Authenticator App
Manual entry: 454ML6LG4TJFCZ4KAEDCMPB5U4MOS7AF
482913
Verify and EnableCancel
QR code, manual key and 6-digit code
3
Save your recovery codes
The moment setup finishes, 10 recovery codes appear on screen. These are your spare keys: if you lose your phone or don't have it with you, you can still sign in with one of them. Each code works only once, and this list won't be shown again, so be sure to save it now. Click Download to save them to a file, or Copy to paste them somewhere you trust. Then click I saved them.
The section now says 2FA Active, and you can see how many recovery codes you have left. If you're running low or have lost them, click New recovery codes to get a fresh set. All you need is the current code from your authenticator app; your old codes stop working from that moment on.
The section now says 2FA Active, and you can see how many recovery codes you have left. If you're running low or have lost them, click New recovery codes to get a fresh set. All you need is the current code from your authenticator app; your old codes stop working from that moment on.
Two-Factor Authentication (2FA)
Save your recovery codes
If you lose your phone, you can sign in with one of these codes. Each code works once. Keep them somewhere safe: they will not be shown again.
akkxh-cv9t63ey7z-47wp3m2sek-2wxeb55z7t-xq2z4te8t3-tv554a5yv4-7zy9zxhcab-exn9dp5rub-xaxuyhsjar-4c28t7ucyt-c22sj
I saved themCopyDownload
Recovery codes · shown only once
4
Complete the second step when you sign in
From now on, when you sign in from a new browser or device, Pumpynotes asks for one more step after your password. Open the authenticator app on your phone, type the current code into the Authentication code field, and click Verify. You'll get the same step when you sign in with your Google, Microsoft or Apple account.
You don't have to enter a code every time: the browser where you entered it is remembered for 30 days, and you won't be asked for a code there during that time. If your phone isn't with you, click Phone not with you? Use a recovery code and enter one of the codes you saved. That's it; your account is now one step safer.
You don't have to enter a code every time: the browser where you entered it is remembered for 30 days, and you won't be asked for a code there during that time. If your phone isn't with you, click Phone not with you? Use a recovery code and enter one of the codes you saved. That's it; your account is now one step safer.
Back to home
Pumpynotes
PumpynotesTwo-factor authentication
Enter the 6-digit code from your authenticator app.
Authentication code*
735204
Verify
Phone not with you? Use a recovery codeBack to sign in
Sign-in screen · two-factor authentication
Turning on two-factor authentication doesn't sign out the sessions already open on your account. If you'd like to see which devices are connected to your account, take a look at Change your password and manage your sessions.
Frequently asked questions
I lost my phone. What should I do?
On the sign-in screen, click Use a recovery code and sign in with one of the codes you saved. Then turn off two-factor authentication on the Security page and set it up again on your new phone; you'll get new recovery codes along the way. If you're out of recovery codes too, write to [email protected]. Our support team will reset two-factor authentication once they've verified your identity.
How do I turn off two-factor authentication?
On the Security page, click Turn off in the two-factor authentication section. Enter the current code from your authenticator app or an unused recovery code, then click Turn off 2FA. When you turn it off, your recovery codes are deleted and remembered browsers are forgotten; if you turn it back on later, your browsers will ask for a code again.
Which authenticator app should I use?
Any authenticator app that generates time-based 6-digit codes will work. Search for "authenticator" in your phone's app store and pick one you like.
Will I be asked for a code when connecting Claude?
Yes, if you need to sign in to Pumpynotes while connecting, you'll be asked for a code too, unless your browser is remembered. If you already have an open session in your browser, you won't be asked to sign in at all.