Passkeys, two-factor and an Account page
Sign in with a passkey instead of a password, or add a 6-digit code from an authenticator app after it. The new Account page, in the account menu, changes your name, email and password, lists the browsers signed in and signs them out, and deletes the account. Owners and admins can require two-factor for their team.
Passkeys are added on the Account page, one per device or synced through your password manager, and offered in the sign-in page's email field. A passkey sign-in asks for no code: the passkey is the second factor.
Turning on two-factor shows a QR code for 1Password, Google Authenticator, Authy or any TOTP app, then ten backup codes that each sign in once. You can trust a browser for 30 days at the code step.
Changing a verified email is approved from the current address, then confirmed at the new one. Deleting the account needs your password, and is refused while you own a team: transfer it or delete it first.
Require two-factor in a team's Settings and members without it are sent to their Account page to turn it on before they can open the team.
More in Passkeys and two-factor.