1 min readUpdated
Open Settings → Account → Security and turn on Two-factor authentication. Scan the code with an authenticator app (1Password, Google Authenticator, Authy), then type the six digits it shows. From then on, signing in asks for a code from your app.
Recovery codes
You are given recovery codes when you turn it on. Keep them somewhere safe: each one works once in place of a code. New recovery codes makes a fresh set, and the old ones stop working.
Wrong codes
After 5 wrong codes, the code step locks for 5 minutes. Each lock after that is twice as long, 10 minutes, then 20, and so on, up to a day. The count is kept for your account, not for one browser, so signing in somewhere else does not reset it. A right code clears it.
If someone else is trying
The first time it locks, a security notice in the app says someone entered several wrong codes for your account. If it was not you, change your password.
Turning it off
Turn it off in the same place. Formkit tells you in the app whenever two-factor is turned on or off.