Keep your account safe

<!-- order: 5 -->

• Turn on two-step sign-in. On your account's security page, scan the QR code with an authenticator app (Microsoft Authenticator, Google Authenticator, 1Password, Aegis…) and enter the code it shows. From then on, signing in with a password also asks for a code from your phone.
• Save the recovery codes you get when you turn it on. Each works once if you lose your phone.
• Use a long password: at least 12 characters. A few unrelated words are easy to remember and hard to guess.
• Link the services you sign in with (Google, Microsoft, Apple, GitHub) on the security page, so you are not locked out if you forget your password.

Every change to your password, two-step sign-in or linked services is e-mailed to you, so you notice a change you did not make.