Two-factor sign-in asks for a 6-digit code from an authenticator app (such as Google Authenticator or 1Password) as well as your password, so a stolen password alone can't open your account.
Turn it on
In Settings, find Two-factor sign-in, scan the QR code with your authenticator app, and enter the code it shows. From then on you'll be asked for a code at sign-in.
If you lose your phone
Contact support. For your safety we confirm it's you before removing two-factor sign-in; you can set it up again after signing in.
Other protection on every account
You get an email when there's a sign-in from a new device or when your password or two-factor settings change, and you can sign out other devices from Settings.