Account Settings: Security
Security, at /account/security, holds everything about how you log in. Open Account Settings from the account menu at the top right and choose Security in the menu on the left. Your login email shows under the heading. See Account Settings page for the other sections.
Each section says how a change went next to its button.
Password
Section titled “Password”Enter your Current password and a New password, then select Change password. The rules show under the new password. Your other devices are logged out, and your address gets a “password was changed” message.
| Message | What it means |
|---|---|
| “Your current password isn’t right.” | Check the current password. Wrong tries here count toward the lockout. |
| “Choose a password that’s different from your current one.” | The new password is the same as the current one. |
Forgot the current one? Log out and use Forgot password? on the login page.
An account made with Google or Microsoft has no password. The section then says “This account has no password” and has one button, Set a password. It emails you a link, and you choose the password on the page the link opens.
Passkeys
Section titled “Passkeys”Lists your passkeys by the names you gave them, each with a trash can (Remove). To add one, enter a Name for a new passkey and select Add a passkey, then follow your device’s prompt.
- If the device’s prompt is closed or refused, the page says “No passkey was added. Try again, or use a different device.”
- The trash can asks first. The passkey stops working, and your other devices are logged out.
- If a passkey is the only way into your account (no password and no connected account), it can’t be removed until you add another.
- A browser that can’t use passkeys shows “This browser can’t create passkeys.”
Authenticator app
Section titled “Authenticator app”Shows On or Off.
- Set up an authenticator app shows a QR code and, under Can’t scan it? Enter this key in the app, the same key as text with a Copy button. Enter the Code from your authenticator app and select Turn on. Cancel leaves it off.
- Remove the authenticator app asks first. Logging in with your password stops asking for a code, and your other devices are logged out.
An account has one authenticator app at a time. To move to a new phone, remove it and set it up again.
Connected accounts
Section titled “Connected accounts”Shown when the site offers Google or Microsoft login. Each line has the provider, the account connected to yours (or “Not connected”), and Connect or Disconnect.
- Connect takes you to Google or Microsoft to log in there, then back to this page, which says “Connected. You can log in with it from now on.” The account’s email address doesn’t have to match yours. Your address gets an email saying an account was connected.
- Disconnect asks first. That account stops logging in here, and your other devices are logged out.
| Message | What it means |
|---|---|
| “That account is already connected to a different login here.” | A Google or Microsoft account connects to one account on the site. Disconnect it there first. |
| “Your Google account is the only way into your account. Set a password or add a passkey first.” | Disconnecting it would leave no way to log in. |
| “That didn’t finish. Try again.” | You cancelled at the provider, or more than 10 minutes passed since you last confirmed it’s you. |
Email address
Section titled “Email address”Shows the address you log in with. To change it, enter the New email address and select Send a code to the new address. Enter the Code from the email and select Confirm new email. Your address changes only then, so a mistyped address can’t lock you out. The old address gets a message saying the address changed.
The code works for one hour, in the browser you asked from. Cancel drops the change.
Other devices
Section titled “Other devices”Log out everywhere else logs out every other browser and device. This one stays logged in.
Confirm it’s you
Section titled “Confirm it’s you”Changing a passkey, the authenticator app, a connected account, or your email address more than 10 minutes after you logged in opens a Confirm It’s You box. Select Use your passkey, or enter your Password and select Confirm. The change you asked for then goes through.
With a Google or Microsoft account connected, the box also has Continue with Google (or Microsoft). It takes you there and back, the page says “Confirmed it’s you. Go ahead with your change.”, and you select the change again. It has to be the account that’s connected: another one shows “That isn’t the account connected to this login. Nothing was confirmed.”
On a phone
Section titled “On a phone”The Account Settings menu becomes a button above the section that names the one you’re on; tap it to open the list. Buttons and their status messages wrap onto separate lines.