Account security lives on the Account Security Settings page. You can turn on two-factor authentication with an authenticator app (TOTP), and you can add passkeys, which use your device's fingerprint, face recognition, or PIN and can't be used on phishing sites.

After you set up 2FA you'll get recovery codes. Store them somewhere safe, since each one works only once and you'll need them if you lose your authenticator. On a team workspace, admins can also require every member to have MFA enabled, as covered in Two-Factor Enforcement. The full details are in our MFA docs.