You can now protect your Examplary account with two-factor authentication. Once it's on, signing in with your password also asks for a short code from an authenticator app, so a leaked or guessed password isn't enough to get into your account on its own.
Turn it on under Account → Security. Scan the QR code with an authenticator app such as 1Password, Google Authenticator or Authy, enter the code it shows, and you're set. From then on every password sign-in asks for a fresh code. You can turn it off again at any time from the same place.
For schools and organizations, admins can make it mandatory for everyone. Under Account → Access & domains, switch on Require two-factor authentication and any member who signs in with a password has to set up an authenticator app before they can carry on. People who sign in through Google, Entree Federatie or a magic code aren't affected — their sign-in method already handles this for them.
If someone loses their phone or authenticator app, an admin can reset it for them from Account → Members, and they'll set it up again the next time they sign in. Every reset is written to your audit log, so there's always a record of what changed.