Notion 2FA: How to Turn On Two-Step Verification (2026)

To turn on Notion 2FA, open Settings, select your name, and under Account security add a verification method next to 2-step verification, then pick an authenticator app or a text-message code. Save the backup codes Notion shows you during setup, because they’re how you get back in if you lose your phone.

That’s the short version. Below is the full walkthrough, plus what Notion’s new rule on password logins (announced in October 2026) means for your account.

Why “Notion 2FA” is suddenly everywhere

In mid-October 2026, Notion published a blog post titled Making password login safer on Notion. The headline change: logging in with a password will require a second verification step.

According to Notion’s post and coverage from Technobezz and Notion Coach:

• New or changed passwords: if you set or change a password, Notion walks you through setting up two-step verification with an authenticator app or phone number.
• Existing password-only accounts: these are being moved over in stages over the coming months. Notion says it will give notice and a deadline before it switches off password-only login.
• Already using a password plus 2FA: no action needed.
• Not using a password at all: passkeys, email codes, Google, Apple, Microsoft and your organization’s SSO stay available, so you aren’t affected.

As of October 28, 2026, Notion hasn’t published one fixed enforcement date for everyone. Technobezz also reports that some unused passwords may be disabled where another login method is confirmed to work. Watch your inbox for a notice from Notion, and treat any deadline in that email as the one that applies to you.

Before you start

Notion’s two-step verification help page lists two requirements:

1. Your account needs a password. If you only log in with email codes or Google, there’s nothing for 2FA to protect yet.
2. Your organization can’t require login through an identity provider (such as Okta or Google Workspace). In that case your company’s identity provider handles security, and you set up MFA there instead.

The feature is available on all Notion plans, including free.

How to set up Notion 2FA

With an authenticator app (recommended)

1. Open Notion and go to Settings in the sidebar, then select your name.
2. Under Account security, find 2-step verification and choose the option to add a verification method.
3. Pick Authenticator app.
4. Open your authenticator app (any standard TOTP app works) and scan the QR code Notion shows.
5. Give the method a name so you can recognize it later, for example “Work phone.”
6. Enter the six-digit code from your authenticator app to confirm.
7. Save your backup codes (see below) before you close the window.

With a text message

1. Go to Settings, select your name, and open Account security.
2. Add a verification method next to 2-step verification and choose text message.
3. Enter your phone number and type in the code Notion sends you.
4. Save your backup codes.

Notion notes that depending on your region, you may only be offered the authenticator app option.

Authenticator app vs. SMS

The SIM-swap point is general security practice rather than something specific to Notion: an attacker who talks your carrier into moving your number can receive your SMS codes. If you have the choice, use an authenticator app and add a phone number only as a fallback.

Save your backup codes

When you first set up two-step verification, Notion gives you six backup codes. Each one works once. If you lose your verification device, these are your way back in. Once you’ve used all six, you can generate a fresh set in your settings.

Store them somewhere that won’t disappear with your phone: a password manager entry, or a printed copy somewhere safe. Don’t keep them only in a note on the same phone that runs your authenticator.

To use one at login, enter your email and password, choose Try another method at the verification prompt, then pick Use backup code.

Managing your verification methods

Notion lets you register up to four methods: two authenticator apps and two phone numbers. Adding a second authenticator (say, on a tablet) is a good way to avoid lockouts.

To change or remove a method:

1. Go to Settings, select your name, and find 2-step verification under Account security.
2. Choose Change verification method. Notion will ask you to verify with one of your active methods first.
3. To delete a method, hover over it, click the ••• menu, choose Delete, and confirm.

Notion’s official help page doesn’t clearly describe a separate “turn off 2FA entirely” switch, and with the new password-login rule, removing your last method may not leave you with password-only login for long anyway. If you want fewer prompts, a passkey is the better route (more on that below).

If you’re locked out

Work through these in order:

1. Use a backup code as described above.
2. Use another login method you’ve already connected. Notion says you can sign in with an emailed code or a linked Google, Apple or Microsoft account instead of your password.
3. Contact Notion support. If you can’t get email at your account address and your other methods don’t work, Notion’s help pages point you to team@makenotion.com. Notion doesn’t publish a response time.

Only use Notion’s official support channels. Notion support will never need your password or backup codes, so don’t share them with anyone claiming to help you recover your account.

Passkeys: the alternative to password plus 2FA

If the new rule has you thinking about how you log in, consider a passkey. Notion’s passkeys help page describes them as a way to skip passwords entirely: you confirm with the same method that unlocks your device (fingerprint, face or PIN), and the passkey is tied to your account in a way that makes phishing harder.

To add one on web or desktop, go to Settings, select your name, and choose to add a passkey under Account security. On mobile, it’s under Settings then My settings. You can store passkeys in iCloud Keychain, your Chrome profile, a password manager such as 1Password or Bitwarden, or on a hardware key like a YubiKey. Notion allows up to five passkeys per account.

Like 2FA, passkeys aren’t available if your workspace requires login through an identity provider.

What workspace owners can (and can’t) enforce

If you run a team workspace, know the limits. Notion’s help center says workspace owners can’t require two-step verification for all users at this time.

The closest built-in control is MFA enforcement, which is Enterprise-only and applies to guests, not members. An organization owner turns it on from the Security tab in organization settings under guest workspace access restrictions, choosing which workspaces require it.

For members, the usual approach on Enterprise is to require SAML SSO and enforce MFA in your identity provider. Notion warns that all members should be added to the identity provider before you switch that on, to avoid locking people out.

Our take

Turn it on now rather than waiting for Notion’s deadline email. Use an authenticator app as your main method, add a second authenticator or phone number as backup, and put the six backup codes in your password manager. If you’d rather not deal with codes at all, a passkey gives you strong protection with less friction. Notion’s rollout is still in progress, so details may change after October 2026; check the official help pages if something in your settings looks different.