Short answer: Open Settings → My account and enable two-step verification, then add an authenticator app or a passkey. If you sign in with Google or Apple, or your workspace uses SAML SSO, authentication happens there instead — secure that account. Then check who has access to your workspace and whether any pages are shared publicly on the web.
What a Notion workspace holds
More than most people realise, because Notion becomes the place everything ends up.
Meeting notes, product roadmaps, client documentation, financial models, hiring notes, and — with depressing regularity — a page of credentials someone made “temporarily”. For a small business, the Notion workspace is often a more complete picture of the company than any single other system.
There is also the public sharing angle, which is a bigger practical risk than account takeover. Notion pages published to the web are indexed by search engines. Internal documents have been found this way many times, with no attacker involved at all.
First: how do you sign in?
Three possibilities, and they change what you should do:
- Email and password — Notion’s own 2FA applies. Follow the steps below.
- Google or Apple sign-in — authentication happens at that provider. Secure it there: Google, Apple.
- SAML SSO (Enterprise plans) — your organisation’s identity provider handles it, and Notion’s own 2FA setting will not apply. See what is single sign-on.
Notion also supports email login codes — a one-time code sent to your inbox instead of a password. Convenient, and it makes your email security effectively your Notion security. The same argument as email-based 2FA.
Step 1: Enable two-step verification
- Open Notion and click Settings in the sidebar.
- Go to My account.
- Find Two-step verification and enable it.
- Confirm your identity when prompted.
Step 2: Add an authenticator app or passkey
Notion supports passkeys as well as standard authenticator apps and SMS.
- Passkey — the strongest option. Bound to notion.so, so a phishing page cannot use it. See passkeys vs 2FA.
- Authenticator app — scan the QR code with Google Authenticator, Aegis, 2FAS, Microsoft Authenticator or a password manager. Start with what is an authenticator app if this is new.
- SMS — avoid where an alternative exists; exposed to SIM swapping.
Do not screenshot the QR code, and be careful configuring this during a screen share — Notion is a tool people demo constantly.
Save any backup codes offline: where to store backup codes safely.
Step 3: Audit your sharing settings — the bigger risk
This deserves more attention than the login, because it is where Notion incidents actually come from.
- Published pages. Check Settings → Sites or review pages with a Share to web toggle enabled. Anything published is potentially indexed by Google. Turn off search engine indexing on published pages that do not need it, and unpublish what should never have been public.
- Public links. “Anyone with the link” sharing means exactly that — links get forwarded, pasted into tickets, and end up where you did not expect.
- Guest access. Review guests page by page. Contractors and clients accumulate, and guest access often survives the project by years.
- Integrations. Under Settings → Connections, review third-party integrations with API access to your workspace. Each holds a token that works without 2FA.
- Duplicated templates. If you have duplicated a public template, check it did not bring sharing settings with it.
A quick search of your own domain on Google with site:notion.site can be an uncomfortable but useful exercise.
Step 4: For workspace admins
- Members list — remove people who have left. On paid plans this also saves money, which helps make the case.
- Admin roles — keep the number of workspace owners small.
- Enforce SSO if you are on Enterprise, and require strong methods at the identity provider — how to enforce 2FA in Workspace.
- Allowed email domains — restrict who can join.
- Offboarding checklist — including transferring page ownership, which is easy to forget and awkward to fix later. See 2FA for small teams.
The credentials-in-Notion problem
Worth saying directly: passwords, API keys and recovery codes end up in Notion pages constantly, because it is convenient and everyone is already there.
Do not. A shared workspace is not a secrets store — it has broad access, public sharing features, integrations with API access, and no encryption model designed for credentials. Use a password manager with shared vaults instead, which also solves the “how do we share a 2FA code” problem properly.
If your workspace already contains credentials, treat them as exposed: rotate them, then move them somewhere appropriate.
Frequently asked questions
Does Notion support passkeys?
Yes, Notion supports passkey sign-in. If it appears in your account settings, take it — it is stronger than a code and quicker to use.
Why can’t I find two-step verification?
You are probably signing in with Google, Apple or SSO, so Notion is not handling authentication. Secure the upstream account instead.
Which authenticator app works with Notion?
Any standard TOTP app — see how TOTP codes work.
Why is my code rejected?
Usually clock drift on your phone. Turn on automatic network time — why 2FA codes get rejected.
What if I lose my phone?
Use a backup code or your email login code, then re-enrol. On a team workspace an admin may be able to help. See recovering accounts after losing your 2FA phone.
Are my Notion pages encrypted?
Encrypted in transit and at rest, but Notion holds the keys — so content is readable by the service. That is normal for collaborative tools, and another reason not to store secrets there.
The bottom line
Enable two-step verification or a passkey, check whether SSO already handles it, and save any backup codes. Then spend the larger share of your time on sharing settings and guest access — because with Notion, the documents that leak usually walk out through a public link rather than a stolen password.
Securing the rest of your work stack? See Slack, Zoom and Atlassian.
One Response