Signed-in users can also find this guide, with screenshots, under Help in the app.
With two-step verification on, signing in asks for your password and then a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in.
Install an authenticator app on your phone if you don't have one, for example Microsoft Authenticator, Google Authenticator, 1Password or Authy.
Select your initials at the top right, then select My account.
Find the Two-step verification section. The badge next to the title shows off.
Select Set up authenticator app. A QR code and a setup key appear.
In your authenticator app, add an account and scan the QR code. If you can't scan it, type the key shown below the steps instead.
Type the 6-digit code your app shows into Code and select Turn on.
You see Two-step verification is on. Your other devices will ask for a code. The badge changes to on.