Optional extra steps

Two extra checks a person can choose for their own sign-in, what they ask for, and why they do not count as two-factor verification.

On this page

Status: In development. Two extra sign-in steps exist that you can turn on for your own account. They are optional, they are available only where your organization allows them, and you may not see them at all. This page describes what they look like when they are on.

An extra step is not the same as the second step an authenticator app or a passkey gives. Both extra steps add a check, but neither counts as two-factor verification. They do not replace a passkey or an authenticator app where one is required, and they do not count as a second factor when you recover your account. The sign-in screen says so itself: This is an extra step you turned on. It adds a check, but it does not make your sign-in two-factor.

The two steps#

Step	Asked when	What you type
Use my password	After you sign in with an emailed link or a linked account	Your password
Email me a code	After you sign in with your password	An eight digit code from an email

You turn each one on or off yourself, on the Two-step verification page of your account, under Extra steps. The account page can only change them from a browser your account has used for 24 hours, so a brand new browser sees a notice titled This browser is new to your account instead. A browser counts only once a sign-in that proved more than the password has made it known: a password alone does not, so the notice suggests signing in once with an emailed link or code and coming back after a day. See Security and passkeys.

An account that already has an authenticator app or a passkey is not asked for an extra step. It is asked for its real second factor whenever a sign-in asks for one (when it looks unusual, or an application or organization requires it). See The second step. The one exception is an account whose only second step is a passkey: if it is lost, the same emailed code is offered as Email me a code instead, with its own wording and notices. That is a fallback the platform offers, not an extra step you turn on; see If you lost your passkey.

The password step#

After an emailed link or a linked account, the Confirm it is you screen says Type your password to finish signing in.

Type your password in Password.
Select Verify.

The page offers this step only if the account has a password to answer it with. It adds a check, but it does not protect you against someone who already knows your password.

The emailed code step#

After a password, the screen says We will email an 8-digit code to the address you are signing in with. Nothing is sent until you ask.

Select Email me a code. The screen then says If this address can sign in, a code is on its way. Enter it below.
Open the email and type the code in Code from the email. The hint says Eight digits.
Select Verify.

If no email arrives, the row Nothing arrived? has a button that counts down as Send again in a clock, then becomes Send again. When it sends again, the page says If this address can sign in, another message is on its way. The code goes to the same mailbox as any other message from the sign-in, so it does not protect you against someone who controls that mailbox.

What can go wrong#

What you see	What it means
That code is not right or has expired.	Check the digits, or send the code again.
That extra sign-in step is not available for your account right now.	The step cannot be answered for your account at the moment. Use another way if the screen offers one, or start again.
Enter your password to continue.	The password was not given. Type it and try again.
We could not send email right now. Try again in a few minutes.	The code could not be sent. Wait and try again.

The two steps#

The password step#

The emailed code step#

What can go wrong#

Not offered on an unfamiliar sign-in#

Related#