Turn on two-step sign-in
Add a code from an authenticator app to your sign-in, and require it for the whole firm.
Two-step sign-in asks for a six-digit code from an authenticator app after your password. Someone who learns your password still cannot get in without your phone.
- Choose Two-step sign-in at the foot of the side menu.
- Use the button to open the set-up in your authenticator app, or enter the key by hand.
- Type the code the app shows to confirm.
- Save your recovery codes somewhere safe. Each one works once if you lose your phone.
From then on, signing in asks for a code after your password. You can turn two-step sign-in off from the same place.
Admins without two-step sign-in see the button highlighted as a reminder.
Requiring it for everyone
On Practice and Firm, owners and admins can require two-step sign-in for every member in Settings, under Security controls. Members who have not set it up are asked to before they can continue.
Tip: Signing in also checks passwords against known breaches, and repeated failed attempts are slowed down.