Two-step verification

With two-step verification, signing in asks for your password and a 6-digit code from an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password…).

Turn it on

1. Open My account → Security → Two-step verification and press Turn on.
2. Scan the code with your authenticator app (or type the key).
3. Enter the 6-digit code the app shows.
4. Save the 10 recovery codes somewhere safe. Each works once if you lose your phone; they are shown only once.

When signing in you may tick Remember this device for 30 days. Forget remembered devices in Security cancels that.

Passkeys

With two-step verification on, you can also add a passkey (Face ID, fingerprint, your phone's screen lock or a password manager) in My account → Security → Passkeys. At the second sign-in step press Use a passkey instead of typing the code. Passkeys only work on gawazy.com, so a fake site cannot use them. The authenticator app and recovery codes stay: you still need them to confirm sensitive changes and if you lose the device. Adding or removing a passkey sends you an e-mail.

Lost your phone?

Use a recovery code on the sign-in page (Use a recovery code instead), then set up the app again and get new codes. Gawazy never sends sign-in codes by SMS.