If you're turning on two-factor authentication now
Your recovery code is part of the setup, so there's nothing extra to do.
1. Start setting up your authenticator
Go to Personal settings/Security and click "Enable" in the two-factor authentication section. Scan the QR code with your authenticator app, or enter the key manually.
2. Enter your first code
Type the six-digit code from your authenticator app and click "Proceed".
3. Save your recovery code
The "Save your recovery code" screen shows your code. This is the only time it's displayed, so save it now:
Click "Copy" to copy it, or
Click "Download" to save it as a file.
Keep it somewhere you'll still have access to if you lose your phone - a password manager is ideal. Don't store it on the same device as your authenticator app.
4. Confirm and finish
Tick "I have saved my recovery code" and click "Enable 2FA".
Two-factor authentication isn't switched on until you tick that box, so you can't end up protected with no way back in.
If you already use an authenticator app
If you set up two-factor authentication before recovery codes existed, you won't have one yet. We'll show you a banner at the top of the page telling you so.
Click the button in the banner - it takes you straight to your security settings with the recovery code dialog already open. Save the code as described above, and the banner disappears.
You can also do this at any time from Personal settings/Security without waiting for the banner.
If you currently use SMS codes
SMS two-factor authentication has no recovery code. To get one, switch to an authenticator app - you'll see a banner explaining this, with a button that takes you to the setup.
Switching happens in one step: when you finish setting up your authenticator, we turn SMS off at the same moment. Your account is never left unprotected, and if you change your mind part-way through, your SMS codes carry on working exactly as before.
How to sign in with your recovery code
If you don't have your authenticator app to hand:
Sign in with your email address and password as usual.
At the two-factor screen, click "Use a recovery code instead".
Enter your recovery code and submit.
Your recovery code doesn't expire after one use - the same code keeps working until you replace it. That does mean anyone who has it can get into your account, so treat it like your password.
How to replace your recovery code
Replace your code if you think someone else may have seen it, or if you've lost it.
Go to Personal settings/Security and click "Regenerate recovery code".
Enter a code from your authenticator app.
Save the new code using "Copy" or "Download".
Tick the acknowledgement and click "Save new code".
Your old code keeps working right up until you click "Save new code" - so if you abandon the process, you're not left without one.
Good to know
We never show your code again. Your security settings only tell you whether a recovery code is set, not what it is. If you've lost it, generate a replacement.
Set up a new phone? Your recovery code is one way back in if you no longer have the old device to transfer your authenticator from.