Hi everyone!
From September 2026, new customers and customers resetting their 2FA setup will no longer be able to use email as a 2FA method.
If you already use email as a 2FA method today, you won’t lose access right away. We’re planning to fully decommission email 2FA for existing customers in 2027.
We’re making this change because email is a weaker security option. If someone gets access to your inbox, they may also be able to access security codes or reset links.
To avoid disruption later, we strongly recommend updating your sign-in setup now.
The best setup is:
- a passkey for the fastest sign-in experience
- an authenticator app as your primary 2FA method
- SMS as your backup 2FA method
If you use passkeys, you can set up to 5 across different devices. You can also make them platform-based, so if you save one in your password manager, iCloud Keychain or Google account, it can be available across multiple devices. That gives you more than one way back in if your main device is unavailable.
If you’re using email 2FA today, now’s a good time to switch rather than wait for the 2027 decommissioning. Check out this page for more information and instructions!
