Add a second way to prove it is you

Two-factor sign-in, also called MFA, is your password plus a second check. Settings, Security shows whether it is enabled and lists four methods: passkeys, email code, text message code, and an authenticator app. If the organization requires MFA, the page says so, and you cannot remove the last usable method while that requirement stands.

Codes versus a passkey

An authenticator app gives a fresh six-digit code about every 30 seconds. Set up shows a QR code. If you cannot scan it, type the manual key into the app, then enter the code and verify. Text message code needs a US mobile number: send the SMS, type the six digits, verify. Email code goes to your confirmed email address. You can enroll more than one.

A passkey uses Face ID, Touch ID, Windows Hello, or a security key, with no code to type. Name it after the device, such as Work laptop, so you know which one to remove if the machine is lost. Rename and remove are on the list under Passkeys. Do not rely on a passkey alone. Statxt warns you if it is your only method, because mobile sign-in still needs an email code, a text code, or an authenticator app.

Signing in, and signing out

After the password, Statxt asks you to verify it is you. Pick a method. Your enrolled email and phone are partly hidden. Enter the code or approve the passkey. Resend code is there if the email does not arrive. Removing a method can ask you to verify again, so someone at an unlocked computer cannot turn it off quietly.

Further down the page, Change password takes a new password and a confirmation. Current password is only required if Statxt asks you to sign in again. Email me a link sends a temporary password and signs you out. On the sign-in page, the same job is Forgot password. Where you're signed in shows this device and when the session expires. Sign out on a shared computer. Sign in with lists outside accounts, such as Apple, that you can link.

The click-by-click version lives in the Security & 2FA guide.