Two-step sign-in asks for a code from an authenticator app (such as Google Authenticator, Microsoft Authenticator or Aegis) each time you sign in, so a stolen password alone isn't enough.
Turn it on:
- Sign in at 1kr.uk and open Security → Two-step sign-in → Turn on.
- Scan this with your authenticator app (or type the key), then enter the code it shows.
- Save the recovery codes shown next: Your recovery codes. Each works once, if you lose your phone. Keep them somewhere safe: they won't be shown again.
From then on, the website and 1krNote ask for the code after your password. 1krBlocker isn't affected (it links with a code from the website).
Turn it off: Security → Turn off.
New phone? Move your authenticator to it before resetting the old one, or turn two-step sign-in off and on again on the website. If you lost both the authenticator and the recovery codes, see "Can't sign in on the website".