# Two-step sign-in and backup codes

> Add a second step after your password, with a passkey, an authenticator app or one-time backup codes, and what happens after too many wrong codes.

Two-step sign-in asks for something only you have after your password, so a stolen password isn't enough to get in. It's optional, and anyone can turn it on in **Account → Security** at account.brokerandagent.com.

## Choose your second step

| Method | How it works |
|---|---|
| Passkey | Face ID, Touch ID, Windows Hello or a security key. You can add up to 20. |
| Authenticator app | Any app that makes 6-digit codes. Each code works once. |
| Backup codes | 10 codes, shown once. Each works once. |

Set up more than one. Save your backup codes somewhere safe, like a password manager, for the day you don't have your phone.

## When we ask for it

- **After your password,** before you're signed in to anything.
- **Not after a passkey.** Signing in with a passkey counts as both steps.
- **Not after Google or Microsoft.** They bring their own two-step, so we don't ask again.

We also ask for it when you confirm it's you before a sensitive change, like a new password. See [Signing in](https://brokerandagent.com/help/account/signing-in#changing-how-you-sign-in).

## Too many wrong codes

To stop guessing, wrong codes pause code sign-ins for a while:

- 5 wrong codes pause them for 15 minutes;
- 10 pause them for an hour;
- after that, every fifth wrong code pauses them for a day.

The message says how long the pause has left ("paused for about 14 minutes"). Your passkeys still work during a pause, and we email you about it.

---

Source: https://brokerandagent.com/help/account/two-step-sign-in