Short answer: Sign in to Dropbox on the web, click your avatar → Settings → Security, find Two-step verification and click Enable. Enter your password, choose Use a mobile app rather than text messages, scan the QR code, and save the backup codes Dropbox generates. Add a security key too if the account holds work files.
Why cloud storage is a different kind of target
Most account takeovers are noisy — posts appear, money moves, you notice. A compromised Dropbox can be entirely silent. An attacker syncs a copy of everything and leaves, and nothing about your account looks different.
What is usually in there: tax documents, passport and ID scans, contracts, client work, photos, and — depressingly often — a spreadsheet or text file of passwords. That last one turns a single cloud breach into a compromise of everything else you own.
Dropbox also holds a long history. Deleted files remain recoverable for a period, so “I removed that years ago” may not be true from an attacker’s point of view.
Step 1: Open security settings
- Sign in at dropbox.com.
- Click your avatar (top right) → Settings.
- Open the Security tab.
- Find Two-step verification and click Enable.
- Re-enter your password when prompted.
Do this on the web. The mobile and desktop apps do not expose the full set of security options.
Step 2: Choose the mobile app, not text messages
Dropbox offers two methods:
- Use text messages — codes by SMS. Works everywhere, but the code travels through the mobile network where a SIM swap intercepts it without touching your phone.
- Use a mobile app — a six-digit code generated offline. Choose this.
Select Use a mobile app. Dropbox displays a QR code with a “enter your secret key manually” link beneath it — useful if you are setting this up on the same device. See how to enter a setup key manually.
Scan it with any standard authenticator: Google Authenticator, Authy, Aegis, 2FAS, Microsoft Authenticator, or a password manager with TOTP. Our roundup of the best authenticator apps covers the choices, and the comparison of methods is in SMS 2FA vs authenticator apps.
Do not screenshot the QR code. It holds the raw secret key — and screenshotting it into a folder that syncs to the very account it protects would be a particularly unfortunate loop.
Step 3: Save the backup codes
After enabling, Dropbox shows a set of one-time backup codes under Security → Recovery codes. Each works once in place of an app code.
Save them outside Dropbox. Printed, in an encrypted password manager, on an offline drive — anywhere that does not require the account you are trying to recover. This sounds obvious and it is the single most common mistake people make with cloud storage 2FA.
See where to store 2FA backup codes safely, and how to back up your authenticator app for the broader plan.
Step 4: Add a security key
Dropbox supports FIDO2/WebAuthn security keys as an additional method, and this is the strongest option available. A key is bound to dropbox.com by the browser, so it will not authenticate on a lookalike phishing page — closing the one attack that codes cannot resist.
Under Security → Security keys, click Add and follow the prompts. Register two keys if you can, so losing one is not a crisis. Background: what a hardware security key is and phishing-resistant MFA.
A backup phone number is also offered. Add one only if you understand it becomes another route in — a route that inherits the SMS weaknesses you just avoided.
Step 5: Audit devices, sessions and linked apps
Still under Settings → Security, three lists worth clearing:
- Devices — every computer and phone with the Dropbox app installed. Unlink anything you have sold, replaced, or do not recognise. A linked device holds a persistent session that does not re-check your 2FA.
- Web browsers — active browser sessions, with locations and times. End anything unfamiliar.
- Connected apps — third-party services you granted access. Old photo tools, e-signature services and note apps accumulate here, often with full-account permission. Revoke what you no longer use.
The connected apps list is the one people never check, and it is a genuine risk: a breach at any of those services can expose your files without your Dropbox password ever being involved.
Step 6: If you use Dropbox for work
On a Business or Teams plan, an admin can require two-step verification for all members from the admin console. Do it — one member with a reused password exposes shared folders to everyone.
Also review shared links: Shared → Links shows every file you have shared publicly. Links created years ago for a one-off transfer are frequently still live. Set expiry dates and passwords on anything sensitive, and delete links you no longer need.
Frequently asked questions
Which authenticator app works with Dropbox?
Any standard TOTP app. Dropbox uses the normal algorithm with no proprietary extensions — see how TOTP codes work.
What happens to my synced devices when I enable 2FA?
They keep working. Existing linked devices are not signed out. Two-step verification applies to new sign-ins — which is exactly why unlinking old devices matters.
What if I lose my phone and my backup codes?
Dropbox account recovery involves identity verification with support and is deliberately slow. If you have a security key registered, use that instead. See recovering accounts after losing your 2FA phone.
Why is Dropbox rejecting my code?
Usually clock drift — your phone’s time has drifted from Dropbox’s servers. Enable automatic network time in your date and time settings. Our guide to 2FA codes being rejected covers the other causes.
Does two-step verification encrypt my files?
No. It controls who can log in. Dropbox encrypts files at rest and in transit, but holds the keys — meaning Dropbox can access your content. If you need the provider to be unable to read your files, encrypt them yourself before upload, or use an end-to-end encrypted service.
Should I use my password manager for Dropbox codes?
It is convenient, and better than no 2FA at all. But for an account holding identity documents, keeping the code in a separate app means one compromised vault does not hand over both factors. The trade-off is laid out in password managers with built-in TOTP.
The bottom line
Five minutes: app over SMS, backup codes stored somewhere that is not Dropbox, a security key if the files matter, and a clear-out of linked devices and connected apps. The last part is where the real surprises live — most people find at least one thing they forgot they authorised.
Testing your setup? Our free online 2FA code generator runs entirely in your browser.