Short answer: Click your profile picture → Settings → Login & security, and turn on two-factor authentication. Choose the authenticator app option, scan the QR code, enter the six-digit code, and save the backup codes. If you sign into Canva with Google, Facebook or Apple, your 2FA lives on that account instead — secure it there.
Why a design account is worth protecting
It sounds low-stakes until you think about what is actually in there.
Brand assets. Logos, fonts, colour palettes, templates, and client work. For an agency or freelancer, that is a portfolio’s worth of material, some of it under NDA.
Client and team access. Canva for Teams means one compromised account can reach shared folders across an organisation.
Publishing connections. Canva connects to social platforms for direct publishing. A takeover can post as your brand without ever touching the social account itself.
Payment details on Pro and Teams subscriptions.
And for the many people whose Canva login is their Google login, the account is a doorway rather than a destination — which is the more important thing to check first.
First: how do you sign in?
If you use “Continue with Google”, “Continue with Facebook” or “Continue with Apple”, Canva never sees a password and its own 2FA setting will not apply. Whoever controls that provider account controls your Canva.
In that case, secure the upstream account instead — Google, Facebook, Apple — and you have done the meaningful work.
If you sign in with an email and password, continue below.
Step 1: Open Login & security
- Sign in at canva.com.
- Click your profile picture (top right) → Settings.
- Open Login & security in the left menu.
- Find Two-factor authentication and turn it on.
Step 2: Scan the code
Canva shows a QR code with a text key beneath it for manual entry.
- Open your authenticator app and add a new account.
- Scan the code, or paste the key manually — see entering a setup key manually.
- Type the six digits into Canva to confirm.
Any standard app works — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, Authy, or a password manager. New to this? What is an authenticator app covers the basics; Android and iPhone picks if you are choosing.
Do not screenshot the QR code. Designers screen-share and record constantly, and that image is the account’s permanent key. Set this up with sharing off.
Step 3: Save the backup codes
Canva provides backup codes after setup. Store them offline or in a password manager — not in a Canva document, which is the account you would be locked out of. See where to store 2FA backup codes safely.
Also put the token on a second device while the QR is on screen. If Canva is part of how you deliver client work, a lockout is a deadline problem, not just an inconvenience.
Step 4: Clean up access
Still in Settings, three things worth checking:
- Devices / active sessions — sign out anything unfamiliar or long gone.
- Connected social accounts — Canva’s publishing integrations hold posting permissions. Disconnect what you no longer publish to.
- Apps — third-party integrations added to your account.
If you run Canva for Teams, also review the member list under People. Remove former staff, contractors and agencies, and check who holds admin. A designer who left last year with a live account is a genuine gap — the wider pattern is covered in 2FA for small teams.
A note for freelancers
If clients share Canva folders with you, use your own account with folder-level access rather than logging into theirs. It means access can be revoked cleanly when a project ends, and neither of you carries liability for the other’s account. The platforms you find that work through deserve the same treatment — see setting up 2FA on Upwork and Fiverr.
And be wary of the design-specific phishing lure: a “client” sending a brand kit, brief or asset pack as a file rather than through the platform. Malicious files disguised as design assets are a known route to infostealer malware, which takes session cookies and bypasses 2FA entirely — see session hijacking and 2FA for freelancers.
Frequently asked questions
I can’t find the 2FA option. Why?
Most likely you sign in with Google, Facebook or Apple, so Canva does not manage authentication. Secure that account instead.
Which authenticator app works with Canva?
Any standard TOTP app — Canva uses the normal algorithm. See how TOTP codes work.
Why is my code rejected?
Usually clock drift on your phone. Turn on automatic network time. More: why 2FA codes get rejected.
What if I lose my phone?
Use a backup code, or Canva support with identity verification. On a Teams account an admin may be able to help. See recovering accounts after losing your 2FA phone.
Can I require 2FA for my whole Canva team?
Enterprise and Teams plans offer SSO and administrative controls; the exact options depend on your plan. Where SSO is available, enforce strong authentication at the identity provider — that is the cleaner approach.
Does 2FA protect my designs from being copied?
No. It controls account access. Anyone you share a design or a public link with can still copy it — check your share settings separately, and expire links you no longer need.
The bottom line
Check how you sign in first; that answer decides where the work happens. If it is a Canva password account, three minutes gets you an authenticator app and backup codes. Then spend five more on connected social accounts and old team members, because those are the quiet routes into a design account that people never think to close. And if you are a student or teacher weighing up other design tools, our guide to Figma’s free education plan is worth a look.
Need a code to confirm the setup? Our free online 2FA code generator runs entirely in your browser.