Notion is making two-step verification a requirement for password login, asking people who create or change a password to configure a second check using an authenticator app or a phone number. For existing password users who have not enabled that protection, the company plans a phased rollout over the next few months. The requirement applies specifically to password login, while people using other sign-in methods can continue using them without creating a password.
Notion says it plans to notify people who currently depend on a password alone and give them time to add verification before it disables that way of signing in. The company plans to send affected users their deadline and setup instructions before the requirement takes effect. Users who decline to configure verification can still access Notion through another available method, with an email code among the alternatives the company identifies.
Notion also plans to disable some unused passwords belonging to people who already access their accounts another way. That step depends on the company being able to confirm that the alternative method works for the account. People who already use both a password and two-step verification do not need to take any action for this change.
The company points to password reuse as the reason for requiring another check: a password exposed on a different site could also be tried against a Notion account. Notion says the additional verification step can also support account recovery when another problem occurs. Its other sign-in options include passkeys and email codes, as well as accounts from providers such as Google and Microsoft.
Password users can enable the protection now by opening Settings, selecting their name and finding Account security. Beside Two-step verification, Add verification method leads to the setup choices. Users can select either Code from authenticator or Text me a code and complete the prompts, although Notion says the text-message option might not be offered in all regions.
Notion advises users to store the backup codes supplied during setup somewhere they can retrieve them later. Those codes are needed if a user loses their phone or the device used for verification. Apple sign-in and an organization's SSO also remain options where available.
