Email sign-in codes, trusted browsers, using an authenticator app instead, and resetting a forgotten password.
When you sign in from a browser or phone we have not seen before, we email you a 6-digit code. Enter it and that browser is trusted for 30 days. Somebody who has your password still cannot get in without your inbox too.
Under Security & two-factor, at the foot of every admin page, choose Use an authenticator app. Scan the QR code with Google Authenticator, Microsoft Authenticator, Authy or 1Password, enter the code it shows, and save the backup codes you are given. From then on you enter a code from the app at every sign-in, and email codes stop. Switch back to email codes undoes it.
Lost the phone with the app on it? Each backup code works once, in place of a code from the app.
On the sign-in page choose Forgot password?, enter your email address and follow the link we send.
Forget trusted browsers, under Security, makes every browser ask for a code again the next time it signs in.