Keeping your account secure

Two-step verification, passkeys, sessions and recovery codes.

## Two-step verification
In Security, choose Set up an authenticator app. Scan the QR code (or enter the key) in an app such as 1Password, Google Authenticator or Microsoft Authenticator, then enter the 6-digit code to confirm. Save your 10 recovery codes somewhere safe — each one works once.

## Passkeys
Passkeys let you sign in with your fingerprint, face or device PIN instead of a password. Add one from Security. Passkeys can't be phished and are tied to nxtcloud.app.

## Sessions and devices
Security lists every device signed in to your account. Sign out any session you don't recognise, or sign out everywhere. Changing your password signs out all other sessions automatically.

## If you lose your phone
Sign in with a recovery code instead of the 6-digit code, then set up two-step verification again. If you have no recovery codes left, contact support.