Turn on two-step verification

Protect your account with a 6-digit code from an authenticator app. Set it up, sign in with it, keep your recovery codes safe, and turn it off if needed.

Two-step verification asks for a second proof when you sign in: a 6-digit code from an authenticator app on your phone. A stolen password alone then cannot open your account. It is optional, free on every plan, and works with any authenticator that supports the standard time-based codes, such as 1Password, Google Authenticator, Authy or Microsoft Authenticator.

#Turn it on

You get 10 recovery codes. Each signs you in once if you lose your phone. They are shown only this one time. The row then reads "On · {count} recovery codes left".

If the page says "Not available on this server yet", two-step verification is not turned on for the server you use.

#Sign in with it

After your password (or after Continue with Google), Prior asks for the code.

• Type the 6-digit code from your app under Authentication code, then choose Verify.
• Lost your phone? Choose Use a recovery code instead, type one code (it looks like xxxxx-xxxxx) and choose Verify. Each code works once.
• The sign-in has 5 minutes and 5 attempts. If it runs out, the screen says "This sign-in expired. Sign in again."
• After 10 wrong codes in a row, verification locks for 15 minutes: "Too many wrong codes. Try again in 15 minutes."
• A code works once. If you used it a moment ago, wait for the next one, which comes every 30 seconds.

It applies on every sign-in method, including Google. AI assistants you connect to Prior do not ask for the code each time: once you allowed them, they use their own access, which you can revoke. See Devices and sessions.

#Get new recovery codes

In Settings → Security, choose New recovery codes, enter a current code from your app, and choose Create. The old codes stop working at once.

#Turn it off

In Settings → Security, choose Turn off. Prior asks for a current code from your app or a recovery code, and for your password. If you only use Google, you must have signed in within the last 10 minutes: otherwise sign out, sign in again, then retry. Sign-in then only asks for your password or Google account.

#Good to know

• Your phone's clock must be right for the codes to match. Turn on automatic date and time on the phone.
• Deleting your account also asks for a code when two-step verification is on.
• Changing your password through Forgot password? signs you out everywhere, and the code still applies at the next sign-in.

Updated 5 November 2026