Short answer: Go to your Slack account page at slack.com/account/settings, find Two-Factor Authentication and click Expand → Set up two-factor authentication. Choose Use an app, scan the QR code, enter the code, and save the backup codes. Workspace owners can require 2FA for everyone under Settings & Permissions — and on a work Slack, they probably should.
What a Slack account actually holds
People think of Slack as chat, which undersells the risk considerably.
A work Slack contains years of internal discussion, shared files, customer details, credentials pasted in DMs (everyone says they don’t; everyone does), integration tokens, and the informal context that makes social engineering easy. Someone reading your workspace for a week learns who approves payments, who is on holiday, and how your team talks to each other.
That last part is the real prize. The most damaging attacks that start in Slack are not data theft — they are messages sent from a trusted internal account asking a colleague to process an invoice or reset a credential. Nobody questions a message from a familiar name in a familiar channel.
First: check whether you can
Slack’s own 2FA setting is only available if you sign in with an email and password.
If your workspace uses Google Workspace sign-in, Apple sign-in, or SAML SSO (Okta, Entra ID, OneLogin and similar), Slack delegates authentication entirely. The 2FA option will be greyed out or missing, and the security you need lives on the identity provider — Google, Apple, or whatever your company uses.
That is not a downgrade. SSO with a properly configured provider is generally the stronger setup, because it centralises enforcement and lets admins require phishing-resistant methods.
Step 1: Turn it on
- Go to slack.com/account/settings (or click your avatar → Profile → Account settings).
- Find Two-Factor Authentication and click Expand.
- Click Set up two-factor authentication.
- Enter your password when prompted.
Step 2: Choose the app, not SMS
Slack offers Use an app or Use SMS. Choose the app — SMS codes are exposed to SIM swap attacks, and a work account is exactly the kind of target where that effort is worth an attacker’s time.
Slack shows a QR code with a manual key underneath. Scan it with any standard authenticator — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, or your password manager. New to this? See what is an authenticator app.
Do not screenshot the QR code. Slack is a screen-sharing environment by nature, and a setup QR that ends up in a channel or a recorded call is permanently compromised.
Enter the six digits to confirm.
Step 3: Save the backup codes
Slack shows backup codes right after setup. Save them outside Slack — printed, or in a password manager. Saving them in a DM to yourself is the mistake that defeats the purpose, since Slack is the account you would be locked out of.
See where to store 2FA backup codes safely. On a work account, also note that an admin can reset your 2FA if you are stuck — which is a safety net, but not one you want to rely on during a deadline.
Step 4: Note that 2FA is per workspace, per account
This surprises people. If you are in multiple Slack workspaces with the same email, enabling 2FA covers that account. But if you use different email addresses for different workspaces — common for contractors and agencies — each one is a separate account needing its own setup.
Check every workspace you belong to, including ones you have not opened in months. Dormant memberships are a real risk: you are not watching, but your account is still in the channels.
For workspace owners: require it
Individual opt-in gets you partial coverage, and partial coverage means the attacker simply finds the person who did not bother.
- Go to [workspace name] → Settings & administration → Settings.
- Open Authentication.
- Under Two-Factor Authentication, click Expand and enable the requirement.
- Choose whether it applies to everyone or to admins and owners only.
Everyone is the right answer for most teams. Members are prompted to set it up on next sign-in, and you can force a re-authentication to bring existing sessions into line.
While you are in the admin settings, three more worth reviewing:
- Apps and integrations — every installed app holds a token with scoped access to your workspace. Remove what is unused, and require admin approval for new installs.
- Guest and multi-channel guest accounts — check who is still there from finished projects.
- Session duration — set forced re-authentication periods for mobile and desktop rather than leaving sessions alive indefinitely.
Our guide to 2FA for small teams covers the rollout and offboarding pattern.
The attack 2FA does not stop
Worth knowing, because it is the one actually being used against Slack workspaces: session token theft.
Infostealer malware on a laptop harvests browser and desktop app session tokens. With a valid token, an attacker is already inside — no login screen, no password, no code. Your 2FA is never consulted.
Defences: keep devices patched, do not install cracked software or unvetted browser extensions, set shorter session durations, and sign out of all sessions if a device is ever suspected of compromise. More detail in what is session hijacking and can 2FA be hacked?
Frequently asked questions
Why is the 2FA option greyed out in my Slack?
Your workspace uses SSO or Google/Apple sign-in, so Slack does not handle authentication. Secure the identity provider account instead.
Does Slack support passkeys or security keys?
Not directly in its own authentication. Workspaces on SSO can enforce security keys and passkeys through the identity provider, which is the recommended path for organisations.
Can an admin see or reset my 2FA?
Admins cannot see your codes, but workspace owners and admins can reset a member’s 2FA to unblock them. That is useful, and also a reason admin accounts themselves need strong protection.
Why is my code being rejected?
Usually clock drift on your phone. Turn on automatic network time. Other causes: why 2FA codes get rejected.
What if I lose my phone?
Use a backup code, or ask a workspace admin to reset your 2FA. On a personal workspace with no admin, Slack support is the route. See recovering accounts after losing your 2FA phone.
Does 2FA apply to the Slack mobile and desktop apps?
Yes, on new sign-ins. Existing sessions continue until they expire or are revoked — which is why session duration settings matter alongside 2FA.
The bottom line
Check whether your workspace uses SSO first; if it does, your work is on the identity provider. If not, three minutes gets you an authenticator app and backup codes stored somewhere other than Slack. Owners should require it workspace-wide rather than hoping — and everyone should understand that stolen session tokens, not stolen passwords, are how modern Slack breaches actually begin.
Need a code while setting up? Our free online 2FA code generator runs entirely in your browser.