Two-factor authentication
A password can be watched over your shoulder or lured out by a fake page. With two-factor authentication the password alone is not enough: signing in also takes a six-digit code from an authenticator app on your phone, and that code changes every 30 seconds. It is optional — a choice for those who care about protecting the account.
You turn it on in the Profile, on the “Two-factor authentication” row. Any authenticator app will do: Google Authenticator, Microsoft Authenticator, Aegis, 2FAS or the one built into your password manager. Scan the QR code (no camera — type the key by hand, it is shown below the QR) and enter the code the app shows. Two-factor turns on only after a correct code, so you cannot lock yourself out with a key the app never accepted.
Turning it on signs the account out on every other device — you will sign in there again, this time with a code. That is deliberate: if you turn two-factor on because you suspect someone else got in, their session must not survive it.
Recovery codes
Without these codes and without your phone, the account cannot be recovered - nobody can restore it for you. Keep them somewhere other than this phone.
Without your phone and without the recovery codes the account cannot be recovered — not by e-mail and not by us: we hold nothing that could prove you are you. Keep the codes somewhere other than that phone. Your records are not lost in that case: they live on the device, you can export them and create a new account.
Each recovery code lets you sign in once instead of a code from the app. How many are left is shown in the Profile. When few remain, get new ones: “Two-factor authentication” → “New recovery codes”. All the old ones stop working at once.
A password reset through the link in an e-mail also asks for a code while two-factor is on — otherwise whoever got into your mailbox would get everything. A recovery code works there too.
You turn it off in the same place, with “Turn off two-factor”: it takes your password and a code. A recovery code works as well, so you can turn it off without the phone — as long as you kept the codes.
If the code from the app is not accepted, check the time on your phone first. Codes are computed from the clock, and if it has drifted noticeably the server will reject them. Turning on automatic time usually fixes it.