How does two-factor authentication (2FA) for sign-in work?

Last updated: September 30, 2026

Sign-in two-factor authentication (2FA) adds a second check when you sign in to your Kraken account, on top of your password. If your password is compromised when Sign-in 2FA is enabled, an attacker needs more than just your password to sign in.

We consider Sign-in 2FA a basic security feature that everyone should use, on both your Kraken account and all your email accounts.

Recommended method: Use a Passkey for Sign-in 2FA. Passkeys resist phishing because they only work on Kraken’s real site, so there’s no code to enter on a fake site or share with a scammer. If you choose an authenticator app instead, be aware of the risks: its codes can be entered on a phishing website or shared with a scammer. See Risks of using an authenticator app.

How do I set up Sign-in 2FA?

  1. 1

    Sign in to your Kraken account.

  2. 2

    Go to your Security settings.

  3. 3

    Under Sign-in Two-Factor Authentication (2FA), click Add passkey.

  4. 4

    Follow the on-screen instructions. Depending on your device, browser and operating system, you may be offered different places to save your Passkey, such as your device or a Hardware Security Key.

If you choose Authenticator app instead of a Passkey, be aware that authenticator apps can sync your codes to a Google, Apple or Microsoft account, which exposes them if that account is compromised. See Risks of using an authenticator app.

This is for clients using the Kraken Pro interface (pro.kraken.com)

  1. 1

    Sign in to your Kraken account via https://pro.kraken.com

  2. 2

    Click on your profile icon in the upper-right corner of the page.

  3. 3

    Select Settings and then Security. Scroll down to the 2FA table.

  4. 4

    Select Activate 2FA beside the Sign-in section. If you already have a 2FA set up, select Change method and choose the 2FA method you want to use. The methods available are: Hardware Security Key (most secure) and Authenticator app (moderately secure).

Security Tip

The sign-in 2FA device for your Kraken account should be kept separate from your username and password, as storing this information together would provide an attacker all the information needed to access your account.

Add more than one Sign-in 2FA method

You can add more than one Sign-in 2FA method, so you’re never limited to one device. You can add up to five Passkeys and one authenticator app. For steps and requirements, see How to enable multiple two-factor authentication.

Sign in with your Master Key

If you’ve set up a Master Key, you can use it as an alternative Sign-in 2FA method.

We recommend a Passkey as your Master Key. Keep it on a different device from your Sign-in 2FA, so losing or compromising one device doesn’t expose both. For example, if your Sign-in 2FA Passkey is on your phone, create your Master Key Passkey on a Hardware Security Key.

To sign in with your Master Key

  1. 1

    Go to kraken.com, enter your email or username and password, then click Sign in.

  2. 2

    When asked for your Sign-in 2FA, click Master Key.

  3. 3

    Follow the on-screen instructions for your Master Key’s 2FA method. Once complete, you’re signed in.

If your Master Key uses an authenticator app, consider switching to a Passkey. Codes synced to a cloud account are exposed if that account is compromised. See Risks of using an authenticator app. Enter the code labeled Kraken.com Master Key, not Kraken.com Sign-in, and make sure your device’s time is set to automatic.

Step-up 2FA

Step-up 2FA uses your Sign-in 2FA or your Master Key to confirm sensitive changes such as adding, editing or removing a 2FA method. When you request one of these changes, Kraken asks you to confirm with your Passkey, your authenticator app code or your Master Key. The change can’t go ahead until you confirm. See What is Step-up 2FA?

If you lose your 2FA device

If you lose the device your Sign-in 2FA is on, your account may be at risk, especially if your email account is signed in on that device.

  1. Sign in with another Sign-in 2FA method or your Master Key, then change your password and 2FA methods.
  2. Do the same for your email account.
  3. If you can’t sign in, click Recover account when prompted for 2FA.

If you think someone else has access to your account, see My account is compromised, what should I do?