Login more securely using a passkey, an authentication app, or a text message.

With two-factor authentication (2FA), you can add an extra layer of security to your account by using a login method that only you can access. Use this guide to learn more about each authentication method, enabling and disabling two-factor authentication, logging in using each method, and troubleshooting tips.

After you enable two-factor authentication, you’ll choose from the following methods when logging into your account:

• Passkey
• Authentication app
• Text message

It’s best to enable only one of these methods. Enabling multiple methods doesn’t make your account more secure.

Tip: For added security, follow these steps in a private place where other people can't see your screen.

Before you begin

• If any of your sites have multiple contributors, your contributors can choose to enable two-factor authentication for their own accounts. There isn't a way to enable it for them.
• To keep your account secure, you always need to reauthenticate your current password or social account to do things like change your password or your login method. After enabling two-factor authentication, you’ll reauthenticate your account using your enabled 2FA method. There's a five minute reauthentication window, during which you can perform any actions before you’ll be asked to reauthenticate again.

Using a passkey for two-factor authentication

Passkey authentication is based on using something you have in your possession to login. Your passkey options depend on which browser or operating system you use. Examples of passkeys include:

• Biometric authentication methods, such as Face or Touch ID, or another built-in sensor.
• Security keys, like small USB devices that plug into your computer, or software-based keys, which are built into the device’s operating system.

Enable two-factor authentication via a passkey

You can add up to five passkeys to your account. Follow the steps below each time you set up a new passkey:

1. Open your Two-factor authentication panel.
2. Next to Passkey, click Set up.
3. Enter your Squarespace account password, then click Continue. If you signed up with a social account, click Continue with [social media platform] to verify your credentials.
4. Enter a passkey name in the text field, then click Next. Passkey names have a 20-character limit.
5. Depending on your browser, you’ll be prompted to select a passkey option. Select a passkey and follow the prompts on both your computer and your mobile device (if applicable) to complete the setup process.
6. You’ll receive backup login codes. In the event you can't log in with your passkey, you may need to use a backup code to log in. To learn more, review the Backup login codes section below.

Logging in with a passkey

The first time you log into your account after you enable two-factor authentication, you'll be prompted to select an authentication method after you enter your email and password. To log in with a passkey:

1. Click Use a Passkey, then select the passkey you'd like to use to login.
2. Follow the prompts in your browser and on your mobile device (if applicable) to complete the login process.
3. To skip two-factor authentication on your device the next time you log in, select Remember this computer for 30 days.

Using an authentication app for two-factor authentication

An authentication app generates a code on your smartphone, which you then enter to complete the login process.

Some benefits of using an authentication app include:

• Avoid login issues with limited cell coverage
• Available anywhere, as long as you download an authentication app

Some limitations to consider:

• Requires several steps to enable, which you need to repeat if you get a new phone
• You may need to regularly update the app so it functions properly
• App-based authentication may be vulnerable to malware or phishing attacks

Enable two-factor authentication via an authentication app

Step 1 - Download the authentication app

While you can use any authentication app, we recommend Google Authenticator. The app is available for Android and iOS devices.

• Download for Android
• Download for iOS

Tip: The steps below should work for any authentication app, such as Authy or Duo, but if you have issues, contact your app's support team for more help.

Step 2 - Enable two-factor authentication

1. Open your Two-factor authentication panel.
2. Next to Authentication App, click Set Up.
3. Enter your account password and click Next. If you signed up with a social account, click Continue with [social media platform] to verify your credentials.

Step 3 - Scan the QR code

Open the authenticator app on your phone to scan the QR code.

If you're changing your settings from a mobile device, the QR code won't display. Instead, you'll paste a code manually.

Tip: If your phone's camera is broken or unable to scan a QR code, log into your account on a mobile device and follow the mobile steps below.

Follow these steps for Google Authenticator:

Step 4 - Enter the code

A six-digit number will appear on the Google Authenticator app. Enter this code in your Squarespace account and click Confirm.

A new code is generated every 30 seconds and is valid for 60 seconds. If your code isn't accepted, check the app for a new code, or review our troubleshooting tips.

Step 5 - Receive your backup login codes

In the event you can't log in with the app, you may need to use a backup code to log in. To learn more, review the Backup login codes section below.

Logging in with an authentication app

The first time you log into your account after you enable two-factor authentication, you'll be prompted to select an authentication method after you enter your email and password. To log in with an authentication app:

1. Open the authentication app on your phone.
2. Enter the code from the app on the login screen.
3. To skip two-factor authentication on your device the next time you log in, select Remember this computer for 30 days.
4. Click Log In.

Using a text message for two-factor authentication

With this authentication method, you receive the generated code via text message, and then enter the code to complete the login process.

Some benefits of using text messaging include:

• Quick to set up and use
• Widely used on other apps and services

Some limitations to consider:

• Only available if your phone number is from one of these countries
• Less secure than the other options, although protecting your account with any two-factor authentication method is always more secure.

Enable two-factor authentication via text message (sms)

You can set up two-factor authentication via text message if your phone number is from one of the following countries:

• United States
• Australia
• Canada
• Ireland
• United Kingdom

Step 1 - Enable two-factor authentication

1. Open your Two-factor authentication panel.
2. Next to Text message, click Set Up.
3. If your account is unverified, you need to verify your account email address before you can receive text messages. In the alert that appears, click Send email, then locate the email in your inbox and click Verify now.
4. Enter your account password and click Next. If you signed up with a social account, click Continue with [social media platform] to verify your credentials.
5. Select your country from the Country dropdown menu.
6. Enter your mobile phone number, and click Send Code.

If your account is set up to recover your email address by text message, the phone number you use for it auto-fills here. You can keep it the same or update it, but updating it changes it for your text message account recovery too.

Step 2 - Enter the code

After a few seconds, you’ll receive a text message with your six-digit authentication code. Enter this code in your Squarespace account, then click Confirm.

Codes sent via text message expire after five minutes. If you have trouble logging in, visit Troubleshooting two-factor authentication.

Step 3 - Receive your backup login codes

In the event you can't log in with a text message, you may need to use a backup code to log in. To learn more, review the Backup login codes section below.

Logging in using the text message authentication method

The first time you log into your account after you enable two-factor authentication, you'll be prompted to select an authentication method after you enter your email address and password. To log in using a text message:

1. After a few seconds, you should receive a new text message.
2. Enter the code on the login screen.
3. To skip two-factor authentication on your device the next time you log in, select Remember this computer for 30 days.
4. Click Log In.

Note: If you enable the authentication app or passkey 2FA and the text message 2FA, you won’t receive a text message immediately. Use the authentication app or passkey to get your code instead. Or, to receive a text message, click Use a different method and then select Text message.

Backup login codes

If you lose your phone or are unable to use your authenticator app or passkey, you can use backup codes to access your account. Backup codes only appear once, after you add your first two-factor authentication method to the account. If you add more authentication methods to your account, you won’t receive more backup codes.

Note: If you fully disable two-factor authentication, and then turn it on again at a later time, you’ll receive new backup codes. New backup codes invalidate any old backup codes.

Saving or printing your backup login codes

After setting up a two-factor authentication method when there was no prior method enabled, you'll receive a prompt to copy or download your backup codes. It's recommended to save these codes somewhere secure.

• To save your backup codes to your device, click Copy codes or Download codes.
• To print out your codes, choose the Download codes option, then print the downloaded file.
• To close the setup screen, click Done in the top-left corner.

Using backup codes to log in

Backup codes are generated in sets of eight, and each code can only be used once. To access your account using backup codes:

1. Go to squarespace.com/login.
2. Enter your account email and password and click Log In.
3. Click Use a different method.
4. Click Backup code.
5. Enter an unused backup code in the authentication code field and click Log in.

Troubleshooting backup codes

If the backup code doesn't work, follow these troubleshooting steps:

• Type the code in, rather than copying and pasting it.
• Try a different code from the backup code list. Each code is single-use.

If these steps don't work, or if you don't have your backup codes, contact us.

Generate new codes

If you've used all your backup codes, or lost them and need to generate new backup codes:

1. Open your Two-factor authentication panel.
2. Click Generate new codes next to Backup codes. This invalidates previous codes.

Generate an app password

When you use an app password, you can log into your Squarespace account from apps or devices that don't support two-factor authentication, such as our Developer Platform. To generate an app password:

1. Click this link to open account & security settings in your account dashboard.
2. Click App Passwords, then click Generate Password.
3. Give the password a label, then click Next.
4. Add your account password and click Next.
5. Copy the app password and click Done.
6. Use this app password to log into the app or device.

As long as two-factor authentication is enabled for your account, repeat these steps to generate a new app password any time you need to log into that app or device.

Disable two-factor authentication

Passkeys

If you delete your final passkey, you’ll turn off passkey login.

To delete any unused passkeys:

1. Open your Two-factor authentication panel.
2. Click Manage passkeys.
3. Next to the passkey you want to delete, click Delete.

Authenticator app and text messages

To disable two-factor authentication when using an authenticator app or text messages:

1. Open your Two-factor authentication panel.
2. Next to the authentication method you've enabled, click Turn off.
3. Log in to your account.
4. Click Turn off.

Keep in mind, disabling two-factor authentication also invalidates your backup codes. If you reactivate two-factor authentication, ensure you generate new backup codes.

Troubleshooting

For troubleshooting tips, visit Troubleshooting two-factor authentication.