How to secure your account with two-factor authentication (2FA)

Last updated: October 13, 2026

Two-factor authentication (2FA), sometimes called multi-factor authentication (MFA), adds a second check to your Kraken account on top of your password. If someone gets hold of your password, they still can’t sign in without your 2FA.

Kraken supports two 2FA methods: Passkeys and authenticator apps. We recommend a Passkey wherever you can use one.

Passkeys are our recommended 2FA method because they’re phishing-resistant, thanks to FIDO2 technology. A Passkey can be a Hardware Security Key, a Cross-Device Passkey (created on a mobile device or linked to a keychain or password manager, such as iCloud Keychain or 1Password), or a Device-Bound Passkey (unique to one browser on one device). Which options you’re offered depends on your device, browser and operating system. See What is a Passkey?

You can use a Passkey for Sign-in 2FA and for your Master Key.

Why use a Passkey?

  • Simplicity You confirm your identity the way you already unlock your device, or touch your Hardware Security Key. There’s no code to copy.

  • Security Passkeys use public-key cryptography and only work on Kraken’s real site, so they can’t be phished or reused on a fake site the way a typed code can.

  • Privacy Kraken never sees or stores your Passkey.

An authenticator app is usually installed on a smartphone and generates a 6 to 8 digit code every 30 seconds. You can use one for Sign-in 2FA, Master Key, Funding 2FA and Trading 2FA.

For Sign-in 2FA and your Master Key, if you choose an authenticator app instead of a Passkey, be aware of the risks. Its codes can be entered on a phishing website or shared with a scammer, and codes synced to a Google, Apple or Microsoft account are exposed if that account is compromised. See Risks of using an authenticator app.

Each function has its own 2FA and is set up separately: Sign-in 2FA, Master Key, Funding 2FA and Trading 2FA. See the difference between Sign-in 2FA, Trading 2FA, Funding 2FA and the Master Key.

You can set up a Passkey for Sign-in 2FA and for your Master Key.

  1. 1

    Sign in to your Kraken account.

  2. 2

    Go to your Security settings.

  3. 3

    To set up a Passkey for Sign-in 2FA, select Add passkey under Sign-in Two-Factor Authentication (2FA). To set up a Passkey as your Master Key, go to Advanced Settings, select Enable next to Master Key and choose Passkey.

  4. 4

    Follow the on-screen instructions. Depending on your device, browser and operating system, you may be offered different places to save your Passkey, such as a mobile device, a keychain or password manager, or a Hardware Security Key.

To improve the security of your account and avoid future access issues, we recommend enabling multiple Passkeys. See How to enable multiple two-factor authentication on Kraken.

For Sign-in 2FA and your Master Key, if you choose an authenticator app instead of a Passkey, be aware of the risks. Authenticator apps can sync your codes to a Google, Apple or Microsoft account, which exposes them if that account is compromised. Turn cloud sync off in your app if it has it. See Risks of using an authenticator app.

  1. 1

    Sign in to your Kraken account.

  2. 2

    Go to your Security settings.

  3. 3

    To set up an authenticator app for Sign-in 2FA, select Enable under Authenticator app in Sign-in Two-Factor Authentication (2FA). For Master Key, Funding 2FA or Trading 2FA, go to Advanced Settings, select Enable next to the function and choose Authenticator app.

  4. 4

    Open the authenticator app on your device and either scan the QR code or enter the setup key manually.

  5. 5

    Enter the numeric code that appears in your authenticator app and click Confirm.

You can back up an authenticator app by storing the setup key. Treat the setup key like a password: anyone who has it can generate your codes. Store it offline somewhere safe, and never share it or store it in the same place as your codes.

Keep your Master Key separate from your Sign-in 2FA

Reminder: Keep your Master Key on a different device from your Sign-in 2FA. For example, if your Sign-in 2FA Passkey is on your phone, create your Master Key Passkey on a Hardware Security Key.

Never keep both in the same authenticator app. See Risks of using an authenticator app.

Your Master Key is only needed if you’ve lost your Sign-in 2FA, need to reset your password, or want to remove the Global Settings Lock (GSL) immediately. Keeping it on a different device means losing or compromising one device doesn’t expose both. See What is a Master Key?

Recommended Reading