Settings → Security holds everything about how you sign in and what has been done with your account.
Password
Set a password, or change the one you have. Changing it asks for the current one first.
Two-factor authentication
Turning it on adds a second step to signing in, using an authenticator app.
- Scan the code shown, or enter the key by hand if you cannot scan.
- Enter the six-digit code your app produces.
- Save the recovery codes it gives you. They are how you get back in if you lose the app, and the card shows how many you have left.
Turning it off asks for your password and a current code.
If you sign in with Google, Google's own two-step verification is already your second factor. There is nothing to enable here, manage it in your Google account.
Anything that moves money needs a second factor
Plans, cards, auto recharge and coupon codes all move money, so the Billing tab asks you to enrol in two-factor authentication before it will let you change any of them. Accounts that sign in with Google already satisfy this.
Login email and phone number
Change the address you sign in with; a code is sent to the new address to confirm you can receive mail there. A phone number can be added, changed or removed the same way.
Devices and access history
Known devices lists the browsers and machines you have signed in from. Remove one you no longer use, or do not recognise.
Access history is the record of recent activity on your account, including attempts that failed. If something there was not you, change your password, that ends the other sessions, and remove the device.
Why you are sometimes asked to confirm again
Some actions ask you to prove it is you a second time, even though you are already signed in. This covers the things a stolen session would go for: billing changes, changes to your own security settings, connecting or disconnecting a platform, changing where your files are stored, and changing the public contact address on a creator profile.
You will be asked when it has been a while since you last confirmed, when you are on a different network than last time, or when you are in a different browser. Confirm with your authenticator app if you have one, or ask for a code by email. That option is always available, so you are never locked out for not having an app.
Reading things is never gated this way. Only changes are.
Deleting your account
Deletion is at the bottom of the Security tab and asks you to type a confirmation before it will run. See Access and erasure for what is deleted and what has to be kept.