Stillcode › Two-factor authentication › Etsy

Two-factor authentication on Etsy

Etsy will still read a code out over a phone call. What else it accepts, where its own instructions are, and what happens when the phone holding your codes is gone.

What Etsy supports

These are the second factors Etsy offers on etsy.com. Which ones you see can depend on your plan and your country; what each of the seven actually costs you is set out once.

MethodWhat it is
Authenticator app (TOTP)SupportedComputed on your own device; nothing is sent to produce it.
SMS text messageSupportedTexted to your number, so your carrier is part of the lock.
Voice callSupportedRead out over a call; the same carrier dependency as SMS.
Hardware security keyNot offeredA physical key you tap; the one option phishing does not beat.

Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.

What that particular mix means

Etsy offers both SMS and an authenticator app. They are not equivalent — a texted code depends on your mobile carrier and survives no longer than control of your phone number, while a generated code never travels. If both are enabled, the account is only as strong as the weaker one, because an attacker picks.

Where this page's facts come from

Of the fifty services on this site, six still read a code out over a voice call, and Etsy is one of them. Three of the fifty accept exactly this combination, so the same decision comes up on two other services here. Among the two services filed under retail, not one accepts a hardware security key.

The directory files Etsy under retail, records three of the seven second factors it tracks, and points at instructions published at help.etsy.com/hc/en-us/articles/115015569567#h_01EZCBHFZHS7NBB4VA7NFE9YMX.

Switching on an authenticator app

Etsy's own instructions: Etsy — two-factor authentication — linked, never copied, because a stale menu path here locks people out.

If the phone holding your Etsy codes is gone

Etsy publishes no dedicated page for losing your second factor, which in practice means the route back is ordinary account recovery: proving who you are to support, on their timetable.

Background: how the codes work · what still works when the phone is gone.

Other services in the same place

Amazon Shopify Squarespace WordPress.com

Where Stillcode fits

An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store