Easy for you, hard for anyone else.
Sign in with a passkey, add a second step, and see every device that is signed in. When something looks wrong, we stop and ask before letting anyone through.
- Passkeys
- Four 2-step methods
- Alerts you cannot switch off
Security that starts at the sign-in screen
Passkeys are the simplest way in. Your browser asks for your fingerprint, face or screen lock, and nothing biometric leaves your device. Passkeys only work on our own site, so a fake page cannot use them.
You can also sign in with a password or with a six-digit code sent by email. Add 2-step verification with an authenticator app, a passkey, a text message or one of ten recovery codes.
The Security page gives your account a checkup score, lists every way you sign in, shows where you are signed in, and keeps a record of recent security activity.
Text-message codes are marked as the weakest method on the 2-step settings screen, so you know what you are choosing.
What happens when you sign in
Enter your email
Then choose Continue, or sign in with a passkey straight away.
Prove it is you
A passkey, your password or an email code. Email codes work once and expire in 10 minutes.
The second step
If 2-step is on, confirm with your chosen method. You can let a device skip this for 30 days.
New device check
On a device we do not recognise, we show the device, approximate location, IP address and time, and ask you to approve by email or app notification.
Before sensitive changes
We ask for your passkey or password again, then do not ask again for 10 minutes.
Where you will find it
Sketches of the real screens in the panel, with the names you will see on them.
A checkup score, ways you sign in, where you are signed in and recent security activity.
Account › SecurityEvery device with location, IP, sign-in method, first seen and last active. Sign one out, or all others.
Account › Security › DevicesChoose alerts for new devices and repeated wrong passwords. Some alerts are always sent.
Account › Security › AlertsDevice, location, IP address, time and sign-in method, with a request to approve from your email or app.
Sign in › Confirm it’s youWhat you can set, and where the edges are
The plain facts, so nothing surprises you later.
| Setting or rule | How it works |
|---|---|
| Wrong passwords | After 3, a check that you are human appears. After 5, sign-in is locked for 15 minutes and we email you. Get back in with an email link or reset your password. |
| Too many codes | 5 attempts per code and 5 codes per hour. After that, wait 10 minutes. |
| Sessions | End after 30 days unused, or 12 hours on a device you did not ask to remember. |
| Required alerts | Password changed or reset, 2-step turned off or a passkey removed, and data exported. These cannot be switched off. |
| Recovery codes | 10 single-use codes, shown only after you confirm it is you. Download, print, copy, or make new ones. |
| Password reset | The link works once, for 30 minutes. New passwords need 12 or more characters and are checked against lists of breached passwords. Resetting signs out every other device. |
| Lost everything | Account recovery takes up to 3 working days on purpose. If you own a business, its other admins are told and can object. |
| Security activity | Filter sign-ins, failed and blocked attempts, and changes. Download as CSV. Kept for 180 days. |
Security: common questions
What is a passkey?
Which 2-step methods can I use?
Can I sign in with another company’s account?
What happens if someone guesses my password?
I lost my phone and my recovery codes.
Bring your businesses under one roof
Create your User ID, add a business and open your first channel. Install only the apps you need.