How to secure your account with two-factor authentication

Updated 15 Sep 2026

Your Security page holds how you sign in. Two-factor authentication means a password alone is not enough to get in, which is the single best protection for your account.

1
Open SecurityOpen your profile from the avatar at the top right, then Security. Two-factor authentication is the first card.
2
Turn it onClick Turn on. A QR code appears. Scan it with an authenticator app, like Google Authenticator or 1Password, and type the six digit code it shows. From then on, signing in asks for a fresh code from the app.
3
Change your passwordThe card below. You confirm your current password first. If you sign in with Google, you may not have a password at all, and that is fine.
4
This sessionShows the account you are signed in as and your last sign-in, so you can spot anything you do not recognise.

Stemfra emails you whenever your password changes, two-factor is turned on or off, or your account is signed in from a device it has not seen before. Each of those emails has a "This wasn’t me" button that opens this page. Keep your authenticator app safe: if you change phones, set two-factor up again on the new device before you lose the old one.

That's it.