Help Center › Account & Billing › Two-step sign-in

Two-step sign-in

An optional extra lock: after your password, we email you a 6-digit code, and you type it in to finish signing in.

If someone ever learns your password -- a reused password, a phishing email, a sticky note -- they still can't get into your account without also getting into your email. It's off unless you turn it on.

Turning it on

Go to SettingsFind the Two-step sign-in section and click Set up two-step sign-in.
Click Email me a codeWe send a 6-digit code to the email you sign in with. This proves the codes reach you before anything changes.
Type the code and click Turn on two-step sign-inThat's it. You stay signed in where you are, and every other browser you were signed in on is signed out.

It's set per person. If you have team members, each of them turns it on for themselves from their own Settings -- the codes go to their own email.

Signing in with it on

Sign in as usual with your password or with Google. You'll then see a "Check your email" page: type the 6-digit code from the email we just sent.

Each code works once and lasts 10 minutes. Didn't get it? Check spam, then click Email me a new code (you can ask again after 30 seconds). The newest code replaces the one before.
After 5 wrong codes you start over from your password, and we email you a warning -- if that wasn't you, someone knows your password, so change it.
On your own computer, tick Trust this browser for 30 days to skip the code there. Don't tick it on a shared or public computer.

The Image Depot Live app and Image Depot Sync

Image Depot Live 1.3.0 and newer asks for the emailed code after your password, the same way. An older version of the app can't, so it will tell you to update -- or tap Pair with a code instead and pair your phone from the dashboard on a computer. Image Depot Sync and camera Wi-Fi upload always connect with a pairing code from your dashboard, so nothing changes for them. When you turn two-step sign-in on, the phones and computers you had already connected are signed out -- the Image Depot Live sign-ins and Image Depot Sync pairings that belong to you (a team member's apps aren't touched). We list exactly which ones on the confirmation screen and in the email we send you, and you pair each one again afterwards. Turning it off signs nothing out.

Sessions and connected apps

Image Depot staff sign-ins are tied to the network and browser they started from, so a stolen sign-in cookie doesn't work from somewhere else. For your team: when you remove a team member, their phone's Image Depot Live sign-in, their Image Depot Sync pairing and their other connected-app keys stop working immediately.

Password changes sign your apps out. Changing or resetting the account password also signs out the owner's Image Depot Live and Image Depot Sync apps (you pair them again), and we email the account address every time the password changes, two-step sign-in or not.
Unused apps are signed out after 90 days. The Connected apps list on this page shows each of your app sign-ins with when it was connected and last used.
Wrong passwords pause sign-in. After 10 wrong passwords for your email address in 15 minutes, signing in with it is paused for 5 minutes (15, then 60, if it keeps happening the same day), on the website and in Image Depot Live. We email you the first time it happens in a day. A browser you ticked "Trust this browser for 30 days" on can still sign in, and resetting your password ends the pause.
Changing your sign-in email with two-step sign-in on needs a code we email to your current address, so nobody signed in on your computer can move your codes to another inbox.

Requiring it for your whole team

The account owner can make two-step sign-in required for everyone: Settings, Two-step sign-in, then Require two-step for everyone. Every team member (and you) is emailed. Nobody is locked out: anyone who hasn't set it up yet sees a one-minute setup screen right after signing in, and can use the dashboard as soon as they've turned it on. The owner sees who has set it up yet, and can stop requiring it at any time (everyone is emailed again). While it's required, a person can't turn their own two-step off, and Image Depot Live won't sign them in on a password alone until it's on. The moment you require it, anyone on the team who hasn't set it up yet is signed out of Image Depot Live and Image Depot Sync (their email lists which); they pair again after turning it on.

Turning it off, and trusted browsers

Go to Settings, then Manage two-step sign-in. Turning it off needs a fresh emailed code too, so nobody who sits down at your computer can switch it off. On the same page you can make every trusted browser ask for a code again with Forget all trusted browsers. Changing or resetting your password does that automatically. We email the account owner whenever two-step sign-in is turned on or off for anyone on the account.

Can't get to your email?

Resetting your password doesn't turn two-step sign-in off -- you'll still need a code from your email afterwards. If you've lost access to your email for good, contact us from the email address on your account (or have the account owner contact us) and we'll check it's really you before switching it off.

School Program teachers: when you use Manage to work inside a student's account, you're using your own sign-in -- the student isn't asked for a code. Recent two-step activity (codes sent, sign-ins, wrong codes) is listed on the Two-step sign-in settings page, in Central time.

Last updated 2026-10-07

Still stuck?

Already logged in? Message us from Support Chat in your dashboard.