How to enable multiple two-factor authentication on Kraken

Last updated: October 29, 2026

Adding more than one Sign-in two-factor authentication (2FA) method means you can still sign in if you lose or replace a device. Kraken recommends Passkeys.

You can enable these Sign-in 2FA methods:

•
Up to five Passkeys
•
One authenticator app

A Hardware Security Key must be FIDO2 compatible to be used as a Passkey.

Note: Once you have added your first Sign-in 2FA method, you may be prompted for Step-up 2FA when you add, edit or remove a 2FA method. Read What is Step-up 2FA?

The first Sign-in 2FA method you enable must be a type of Roaming 2FA. This could be a Passkey created with a mobile device, a password manager or a FIDO2-compatible Hardware Security Key. It could also be an authenticator app, but be aware of the risks of using an authenticator app.

Add a Passkey (recommended)

1
Go to your Security settings.
2
In the Sign-in Two-Factor Authentication (2FA) section, click Add passkey. A pop-up will appear: “Create a passkey for kraken.com”.
3
Choose how to create the Passkey. What you see depends on your device, operating system and browser. Follow the steps below for the option you choose.

Passkey on your phone or tablet

Make sure Bluetooth is enabled on both devices. The steps may look different depending on your browser.

1
Sign in to Kraken on a desktop browser.
2
Go to your Security settings and click Add passkey.
3
In the “Create a passkey for kraken.com” pop-up, click Use a different passkey.
4
Click Use a phone, tablet or security key.
5
Scan the QR code with your phone or tablet’s camera (not an app).
6
Follow the instructions on your phone or tablet, and click Save.

Passkey in your keychain or password manager

1
Sign in to Kraken on a desktop browser.
2
Go to your Security settings and click Add passkey.
3
In the “Create a passkey for kraken.com” pop-up, click Use a different passkey.

Steps vary by provider, so we recommend looking up the steps for your specific product, for example Google Password Manager, Apple Passwords, 1Password or Bitwarden.

Passkey on a Hardware Security Key

1
Go to your Security settings and click Add passkey. You may need to click Back, Use a different passkey or a similar option to see all available options.
2
Insert your FIDO2-compatible Hardware Security Key and touch it.
3
Click Allow.

Device-Bound Passkey

A Device-Bound Passkey is locked to one specific device or key. For example, if you create one in Chrome, it is stored in that browser on that device. It cannot leave the device of origin, so you can’t use it in another browser, like Safari, or on another device.

1
Go to your Security settings and click Add passkey.
2
In the “Create a passkey for kraken.com” pop-up, click Continue.

Add an authenticator app

If you choose an authenticator app instead of a Passkey, be aware of the risks. If your codes sync to a Google, Apple or Microsoft account and that account is compromised, your codes are exposed. Your setup key is as sensitive as your codes, so keep it private. Read Risks of using an Authenticator App before you continue.

1
Go to your Security settings.
2
In the Sign-in Two-Factor Authentication (2FA) section, click Enable under Authenticator app.
3
Scan the QR code or enter the setup key in your authenticator app.
4
Follow the onscreen instructions and click Continue.

Note: If you previously enabled a legacy 2FA method such as a YubiKey or a static password, Kraken no longer recommends it. Add a Passkey and remove the legacy method.

Personalize the 2FA description

When you enable 2FA, Kraken assigns a default description. You can change it to something more personal and memorable.

1
Go to your Security settings.
2
Click the three-dot menu next to the 2FA method and select Edit description.
3
Enter a new description and click Save. The maximum length is 256 characters.

Note: You can’t edit the description of a Trading 2FA password, which is a legacy method.

Remove a 2FA method

1
Go to your Security settings.
2
Click the three-dot menu next to the 2FA method and select Remove.
3
If prompted, confirm with Step-up 2FA.

You must always have at least one Roaming 2FA method enabled. To replace a Passkey, add the new one first, then remove the old one.

What if I want to change my only 2FA method?

If you have only one Sign-in 2FA method, add a second one before you remove or replace the first, so you are never locked out.

For example, if an authenticator app is your only Sign-in 2FA and you want to replace it:

1
Add a Passkey. If you wish to use a Passkey on more than one device, enable one using a mobile device, a password manager or a FIDO2-compatible Hardware Security Key.
2
Remove the authenticator app.
3
Keep the Passkey as your Sign-in 2FA.

If you still want an authenticator app as well, you can enable one again from the same section. Read Risks of using an Authenticator App first.

If you can’t access your account

If you have lost access to all methods of Sign-in 2FA, including the Master Key, submit a support request.