Two-step sign-in and backup codes
Add a second step after your password, with a passkey, an authenticator app or one-time backup codes, and what happens after too
Two-step sign-in asks for something only you have after your password, so a stolen password isn’t enough to get in. It’s optional, and anyone can turn it on in Account → Security at account.brokerandagent.com.
Choose your second step#
| Method | How it works |
|---|---|
| Passkey | Face ID, Touch ID, Windows Hello or a security key. You can add up to 20. |
| Authenticator app | Any app that makes 6-digit codes. Each code works once. |
| Backup codes | 10 codes, shown once. Each works once. |
Set up more than one. Save your backup codes somewhere safe, like a password manager, for the day you don’t
When we ask for it#
- After your password, before you’re signed
in to anything. - Not after a passkey. Signing in with a passkey counts
as both steps. - Not after Google or Microsoft. They bring their own two-step, so we
don’t ask again.
We also ask for it when you confirm it’s you before a sensitive change, like a new password. See Signing in.
Too many wrong codes#
To stop guessing, wrong codes pause code sign-ins
- 5 wrong codes pause them
for 15 minutes; - 10 pause them
for an hour; - after that, every fifth wrong code pauses them
for a day.
The message says how long the pause has left (“paused for about 14 minutes”). Your passkeys still work during a pause, and we email
Something missing or wrong? Email support@brokerandagent.com and