Skip to main content

My account - Security

Personal sign-in settings for your own account. Lives at Settings → My account.

For workspace-wide policy (password rules, SSO enforcement, IP allowlist), see Settings → Security - that page is admin-only.

The page has four sections, top to bottom.

Sign-in & password​

Three rows.

Email​

Read-only. The email you sign in with and receive account-recovery messages at. Changing it isn't supported from this page today - contact your workspace admin.

Password​

Click Change password to open a modal.

  • Current password - required, so a stolen session can't change it.
  • New password - the strength meter fills as you meet more of the org's password policy. The four checks (length, mixed case, number, symbol) come from Settings → Security → Authentication; if your admin only requires length, the others are shown but marked optional.
  • Confirm new password - must match. Green border when it does, red with "Passwords don't match." when it doesn't.

When you submit successfully, all your other sessions are signed out immediately - every other browser or app you were logged into is kicked back to the login screen. This is intentional: it's the safest assumption after a password change.

tip

If you suspect your password was compromised, change it from this modal even if you don't know your old one - click Forgot password? to use the reset-link flow instead.

Passkeys​

A passkey is a phishing-resistant alternative to password + 2FA that uses your device's biometric (Touch ID, Face ID, Windows Hello) or a hardware key (YubiKey).

To enroll a passkey:

  1. Click Add a passkey.
  2. A modal opens explaining where you can save the passkey: this device, iCloud Keychain / Google Password Manager, or a hardware key.
  3. Click Continue. Your browser shows the native passkey prompt (Touch ID, Windows Hello, etc.).
  4. Once you authorize, the passkey appears in the list below the Passkeys row with a friendly name (defaults to "This device" / "Phone or tablet" / "Security key" based on what you used).
  5. Click the name to rename it. Click the trash icon to remove it.

To sign in with a passkey: on the login page, click Sign in with a passkey - either on the first email step (the browser picks the account from your stored passkeys) or on the password step after you've entered your email and picked an org.

tip

A successful passkey sign-in skips the 2FA prompt - the passkey is itself a strong second factor by the WebAuthn spec.

warning

If your workspace admin has SSO enforcement turned on, your passkey can't be used to sign in even if you previously enrolled one. You'll have to use the SSO button. Stranded passkeys stay in your account; remove them from this page if you don't want them around.

Two-factor authentication​

Authenticator app​

The only 2FA method available today. Compatible with any TOTP app:

  • 1Password
  • Authy
  • Google Authenticator
  • Microsoft Authenticator
  • Bitwarden

To enroll: click Add. Scan the QR code, enter the 6-digit code from your app, then save the recovery codes that appear. You won't see them again unless you regenerate.

Once enrolled: the card shows the date you enrolled and a Manage button that opens a modal with a Remove option (you'll need a current 6-digit code + your password to remove).

Recovery codes​

10 single-use codes that work in place of an authenticator code - useful if you lose your phone.

note

We never store recovery codes in plain text. We store one-way hashes, the same way we store passwords. That means we can't show you your existing codes later. The Regenerate button creates a fresh set, invalidates your old set, and displays the new ones exactly once - copy or download them right away.

The card shows how many codes you have left. Regenerate when you're down to one or two.

Trusted devices​

Browsers and apps that can skip the 2FA prompt for 30 days. You opt one in by checking "Remember this device for 30 days" on the 2FA challenge screen.

  • Remove on any row revokes that single device - the next sign-in from it will require 2FA again.
  • Sign out everywhere else is more aggressive: it ends your session on every browser and app you're currently signed into, clears every trusted device, and kicks you back to the login page. Use it if you've lost a device, suspect your account was compromised, or just want a clean slate.
tip

"Sign out everywhere" is a real sign-out - the access tokens issued to every other browser are invalidated server-side. Other browsers get kicked out within seconds (up to a 30-second cache window).

If your account doesn't have 2FA enabled, this section is empty - trusted devices only exist when 2FA is on.

info

We're working on a richer Active sessions view that lists every active sign-in (Chrome on MacBook · 3 min ago, Safari on iPhone · 2 hours ago) with per-session sign-out. Until that ships, Trusted devices is the closest thing.

Connected sign-in methods​

Identity providers linked to your individual account, separate from the workspace's SSO configuration. Today: Google Workspace, Microsoft Entra, Okta.

  • Connect launches the OAuth flow with your chosen provider. After you authorize, you're returned here and the row shows the provider email it's linked to.
  • Disconnect removes the link. You'll need to enter your password (or another connected provider) to sign in next time.
warning

You can't disconnect your only sign-in method. If Google is the only way you sign in (no password, no other provider), the Disconnect button is disabled - otherwise you'd lock yourself out. Add another method first, then disconnect.

Connecting one of these providers to your personal account is independent of whether your admin has configured that provider as a workspace SSO option. You can have a personal Google link even if the workspace doesn't use Google SSO.

Best practices​

  1. Enable 2FA the day you create your account. Don't wait for an admin nudge.
  2. Store recovery codes separately from your authenticator. A password manager is fine; the same phone as your authenticator app is not.
  3. Review Trusted devices when you switch laptops - old browsers shouldn't keep skipping 2FA forever.
  4. Use "Sign out everywhere else" the moment you lose a device. Don't wait until you've replaced it.
  5. Keep at least two sign-in methods. Password + 2FA, password + Google, etc. Single-method accounts are one lost device away from being locked out.