A PayPal account is linked to your cards and bank account and pays in a click on thousands of shops, so a stolen password is money leaving your account. With 2-step verification on, PayPal asks for a one-time code from your authenticator as well as the password when you log in — the password alone is no longer enough.
Turn on 2-step verification at PayPal
PayPal lets you set up 2-step verification only in a web browser, not in the PayPal app — which makes a computer the right place to do it.
- Log in at paypal.com in your browser on the computer.
- Click the “Settings” icon next to “Log out”.
- Click “Security” near the top of the page.
- Click “Set Up” to the right of “2-step verification”, choose “Use an authenticator app” and click “Set it Up”.
- Follow the steps on the screen. When PayPal shows a QR code, leave it on the screen and add it to the extension as described below, then enter the code from the extension to finish.
Add PayPal to Authenticator
- Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
- Leave the PayPal page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
- The account appears in the list with a six-digit code that changes every 30 seconds. Rename it if you like — the name is only for you.
- Go back to PayPal and type the current code into the confirmation field. If it is about to expire, wait for the next one.
- PayPal confirms that two-factor authentication is on. From now on it will ask for a code when you sign in — click the extension icon and copy it.
No QR code, or it will not scan? Look for the option to enter a key manually on PayPal’s setup screen, copy the key, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.
Get 2FA Authenticator for Chrome — freeKeep a way back into PayPal
PayPal’s help pages do not describe backup codes for 2-step verification, so plan your own way back before you need it. The simplest is during setup: scan the same QR code with an authenticator app on your phone as well, before you confirm — both will show the same codes. Keep the extension’s automatic backups on, and keep your phone number and email address up to date in your PayPal profile, which PayPal uses to send one-time passcodes when it needs to confirm it is you.
The code is not accepted?
Almost always the computer’s clock. The codes are calculated from the current time, so a clock that is a minute off produces codes that look right and are refused. Turn on automatic date and time in your system settings — step-by-step for Windows, macOS and Linux.
If the clock is right, check the key itself: paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.
Questions
- Can I set up PayPal 2-step verification in the PayPal app?
- No. PayPal says 2-step verification can only be set up through a web browser, not the PayPal app. Log in at paypal.com on your computer — the Authenticator extension can read the QR code straight off that page.
- Can I still use text messages for PayPal 2-step verification?
- PayPal’s help describes setting it up with an authenticator app, and notes that customers who have text-message 2-step verification and turn it off will not be able to turn it on again. An authenticator app also works with no signal and cannot be intercepted with your phone number.
- What if I lose access to my authenticator?
- Use the second copy you set up on your phone, or restore the extension from its backups. If neither is available, click “Contact Us” at the bottom of any PayPal page. Once you are back in, turn 2-step verification off and on again under Settings → Security to set up a new authenticator.
- Why does PayPal say my code is wrong?
- Usually the computer clock is off. Turn on automatic date and time and try the next code. If it still fails, the account may have been added from an old QR code — remove it from the extension and set 2-step verification up again.
Your codes, one click from the login page
Authenticator keeps your 2FA codes in the browser, on your device only — free, open source, no account and no phone needed. Local backups and optional password protection come built in.
Get 2FA Authenticator for Chrome — free