Two-factor, Google sign-in, sessions and password reset
Protect your account with an authenticator app, get back in if you lose it, reset a password, and understand when you're signed out.
Two-factor asks for a code from your phone as well as your password, so a stolen password isn't enough to get in. It works for each person separately. Set it up in Profile on the Security tab, not in Settings.
Turn on two-factor
Before you start: install an authenticator app, such as Google Authenticator or Authy, on your phone.
- 1Open Profile from the profile menu, top right, and choose Security.
- 2Click Enable 2FA.
- 3Scan the QR code with your app, or type in the Manual key.
- 4Enter the 6-digit code from the app, and click Verify & Activate.
- 5Under Save your recovery codes, copy your 10 codes somewhere safe, away from your phone.
- 6Click I've saved them.
You see your recovery codes only once. Without your phone or a recovery code, you can't sign in until our team has confirmed who you are.
What happens next
- Every sign-in asks for a code, whether you use a password or Google. A password reset asks for one too.
- Each recovery code works once. Security shows how many you have left.
- Get new codes gives you 10 new ones and cancels the old set. It asks for a current code first.
- To turn two-factor off, click Disable 2FA, enter an authenticator or recovery code, and click Turn off 2FA. Your leftover recovery codes stop working.
If you lose your phone
We'll ask you to prove who you are before removing two-factor, because a stranger with your password would send the same request. When we remove it, your sessions end and the reset appears in your Activity log. Turn two-factor back on afterwards.
- 1On the Enter your code screen, type one of your recovery codes instead of the 6-digit code.
- 2Once you're in, go to Profile, on the Security tab. Click Disable 2FA, then turn it on again with your new phone.
- 3If you have no recovery codes either, click Contact support on the code screen. Write from your account's email address.
Sign in with Google
- Use Sign in with Google on the sign-in screen, or Continue with Google when you sign up.
- If your Google address already has an account, Google signs you in to it.
- An account created with Google has no password. Keep using Google to sign in: Forgot password? can't send a reset link for it.
Reset a forgotten password
- 1On the sign-in screen, click Forgot password? and enter your email.
- 2Open the email and follow the link. It works for 24 hours.
- 3Choose a new password with at least 8 characters, a letter and a number.
- 4If two-factor is on, enter your code.
The screen shows the same message whether or not the address has an account, so that nobody can use it to test addresses. If nothing arrives, check your spam folder and the address you used.
Change your password
- 1In Profile, on the Security tab, click Change Password.
- 2Enter your current password, then your new password twice.
- 3Save. You'll see Password changed. You've been signed out everywhere else.
Sessions
- A session lasts up to 60 minutes by default. After that you'll see Your session expired. Please sign in again.
- Changing or resetting your password signs you out everywhere else. There's no separate button for this, so if you think someone else has access, change your password.
- Login History on the Security tab is a placeholder showing only this session. The Activity tab lists real sign-ins.
What can go wrong
| Message | What it means | What to do |
|---|---|---|
| That code didn't work. Please try again. | The code is wrong or has already been used | Wait for a new code. Check that your phone's clock is right |
| Too many attempts. Please wait 15 minutes and try again. | You've had 5 wrong codes | Wait 15 minutes |
| This sign-in has expired. Please sign in again. | A code has to be entered within 5 minutes | Sign in again |
| Invalid credentials. | The email or password is wrong | Try again, or reset your password |
| Reset link expired. Please request a new one from Forgot password. | The link is over 24 hours old or has been used | Request a new one |
| Current password is incorrect | You mistyped your current password, or your account uses Google | Try again, or keep using Google |
| This email is linked to a different Google account. | The account belongs to another Google sign-in | Use the original Google account or your password |
| Account Suspended screen | Our team has blocked the account | Use Contact Support on the screen. See account review |
Frequently asked questions
Can I use text messages for two-factor?
No. Two-factor uses an authenticator app. Recovery codes are the backup.
Does Google sign-in skip two-factor?
No. If two-factor is on, you enter a code after Google too.
Can I make two-factor required for my whole team?
No. The switch on the Security tab of Settings is a sample. Each person turns on two-factor for themselves.
Ready to try it?
Open your dashboard and follow along — or create a free account.