Two-factor authentication (2FA) protects your account even if your password leaks.
- Open Account → Security and choose Turn on. Confirm with your password. If you signed in with Google or a sign-in link and have no password, you confirm with your current sign-in instead.
- Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, Microsoft Authenticator). Can't scan? Choose Enter this key and type the key into the app.
- Enter the 6-digit code to confirm.
- Save your recovery codes somewhere safe (password manager or printed). Each code works once if you lose your phone. The Security page shows how many are left, and we email you when two or fewer remain.
Tips
- Owners and Admins should always have 2FA on; Enterprise can enforce it for everyone in the workspace.
- Lost your phone and your recovery codes? Email support@urlcrop.com from your account email; we verify your identity before resetting 2FA, which can take up to 2 business days.
- Signing in with Google uses Google's own 2FA.
- We email you when two-step verification is turned on or off, when recovery codes are regenerated, and after too many wrong codes.
- "Trust this device for 30 days" cannot be listed or removed one by one. To reset every trusted device, turn two-step verification off and on again.
- Codes by email are not offered as a second factor.