Keep your account secure

Your account settings live in Settings → Security in the dashboard. They apply to your account itself, across every workspace you belong to.

Change or add a password

If you sign in with an email and password, you can change it under Settings → Security → Password. You will need your current password, and the new one must be at least 10 characters — avoid your email name and anything guessable.

If you sign in with Google and want a password as a backup way in, choose Email me a code on the same card. We send a 6-digit code to your account email; enter it and pick a password.

After either change we email you a confirmation. "Sign out my other devices" is checked by default — leave it on unless you are sure every signed-in device is yours.

Two-factor authentication

Two-factor authentication (2FA) adds a second step at sign-in: a 6-digit code from an authenticator app such as Google Authenticator, 1Password, or Authy. Even if someone learns your password, they cannot get in without your code.

To turn it on, open Settings → Security → Two-factor authentication → Set up two-factor, scan the QR code with your authenticator app, and enter the code it shows. From then on, every sign-in asks for a current code after your password.

Keep your authenticator safe. There are no backup codes. If you lose access to your authenticator app, account recovery requires contacting support and verifying your identity — plan for that before it happens, as most authenticator apps can back themselves up.

To turn 2FA off, enter a current code on the same card.

If you forget your password

Use Forgot password? on the login page. We email you a reset link: open it, choose a new password, and you are back in. For your security, every other device is signed out when you reset.

If two-factor is on you will also need your authenticator code before you can set the new password. Access to your email inbox alone is never enough to take over a protected account.

The link can be used once and expires after about an hour. If no email arrives, check your spam folder, confirm the address, and send another.

Sessions and security emails

Settings → Security → Sessions shows your last sign-in and lets you sign out everywhere else — useful after using a shared or borrowed computer.

Recent security activity lists the latest changes to your account (password changes, two-factor turned on or off, sign-in methods linked or removed, and sign-outs) with an approximate location and device.

Every security change also sends an email to your account address. If one arrives that you do not recognise, act on it: reset your password immediately and contact support.