From Settings → My Profile, open Security → Two-factor authentication → Manage. That opens the dedicated two-factor page (enrolment is not mixed into the main settings save).
Authenticator app
- Choose the authenticator setup path.
- Scan the QR code in Google Authenticator, Authy, 1Password, Microsoft Authenticator, or any TOTP app — or type the manual key.
- Enter the 6-digit code the app shows.
- Press Turn on authenticator.
Nothing changes on your account until a valid code is accepted. A bad scan only means try again — it does not lock you out mid-setup. Cancel setup if you need to start over.
Email codes
You can also enable codes sent to your sign-in email. Confirm the 6-digit message (they expire in about 10 minutes) to finish enrolment.
Recovery codes
When recovery codes are shown, copy or print them immediately. Each works once. PayBlah stores only a one-way hash and cannot show them again. Keep them where you can reach them without your phone.
After two-factor is on
- Sign-in asks for your password, then a code from the factor you enabled.
- You can disable authenticator or email factor from the same page when you still have access.
- Lost phone and no recovery codes: use support from another channel after you can prove account control — do not share recovery codes in chat.
What this will not do
- It is not forced on every plan by default. You choose when to enable it.
- It does not replace a strong password. Keep both.