Security

You manage how you log in under Account Settings > Security: your password, passkeys, an authenticator app, connected Google or Microsoft accounts, and your email address. Two-step verification is optional for most people and required for site admins.

Passkeys

A passkey logs you in with your device’s fingerprint, face, or PIN instead of your password. It counts as two-step verification on its own: you have the device, and the device checks it’s you.

Open Account Settings from the account menu at the top right and choose Security on the left.
Under Passkeys, give the passkey a name that says which device it’s on, such as “My phone”.
Select Add a passkey and follow your device’s prompt.

Next time you log in, enter your email and select Use your passkey. You can add a passkey on each device you use, and your password keeps working.

Authenticator app

With an authenticator app, logging in with your password also asks for a 6-digit code from your phone. Any authenticator works: Google Authenticator, Microsoft Authenticator, 1Password, and others.

Under Account Settings > Security, select Set up an authenticator app.
Scan the QR code with the app. If you can’t scan it, copy the key under Can’t scan it? Enter this key in the app.
Enter the code the app shows and select Turn on.

A login with a passkey doesn’t ask for the code.

Log in with Google or Microsoft

If the site offers them, Continue with Google and Continue with Microsoft on the login page log you in with an account you already have. There’s no password to remember here, and the account you make that way has none.

To add one to an account you already have, open Account Settings > Security and select Connect under Connected Accounts. You can keep your password and passkeys next to it.

A login through Google or Microsoft counts as one step here, whatever that account asked you for. It becomes two-step with an authenticator app on your account, which the login page then asks for.

If you lose your phone

Forgot your password: select Forgot password? on the login page. A link by email lets you choose a new one.
Can’t get the authenticator code: enter your email and password, then select Can’t use your authenticator? on the code step. A link by email removes the authenticator app from your account, and you log in with your password alone. Set it up again on your new phone.
Lost the device a passkey was on: log in with your password, then remove that passkey under Account Settings > Security.

Each of these also logs out every device that was logged in to your account.

Confirm it’s you

Adding or removing a passkey, the authenticator app, a connected account, or your email address needs a fresh check that it’s you. If you logged in more than 10 minutes ago, a Confirm It’s You box asks for your passkey, your password, or a connected Google or Microsoft account first.

What we tell you

When your password, a passkey, the authenticator app, a connected account, or your email address changes, the account’s email address gets a message saying so. If you didn’t make the change, reset your password right away.

Removing a way to log in, changing your password, and Log out everywhere else log out every other browser and device. The one you’re using stays logged in.

Too many wrong tries

After 10 wrong passwords in a row, or 5 wrong authenticator codes, the account locks. The login page says “This account is locked after too many wrong tries. Reset your password to unlock it.” Resetting your password by email unlocks it.

Site admins

Site admin pages only open for a session that used two-step verification: a passkey, or a password plus the authenticator code. If you logged in with only a password, the site admin pages say so and let you finish there with Use your passkey or your authenticator code. You don’t have to log in again.

A site admin’s role in their own organizations works normally without it. Only the site admin tools need the stronger login.

Download your data

Open Account Settings > Data and select Download my data. You get a data file (JSON) with your profile, your organization memberships, your notification settings, problem reports you sent, and a log of the actions you’ve taken on the site. Saved searches and watched events aren’t in the file; they’re listed on the Saved Searches page.

Delete your account

Open Account Settings > Data and select Delete account.
Type DELETE in Type DELETE to confirm.
Select Delete account. Or select Keep my account to back out.

What happens:

Your profile, memberships, and login are removed, and you’re logged out.
Events you posted stay with your organization. The change history shows “Former member” where your name was.
Your saved searches, watched events, and calendar feeds stop working.
If you’re an organization’s only admin, its longest-standing contributor (or, with no contributors, its longest-standing member) becomes admin and gets an email, “You’re now an admin of Organization”.
It can’t be undone. To use the site again, create a new account.

Where to find it

Account Settings in the account menu at the top right: Security and Data in the menu on the left.