Secure your account

Your account holds what attackers want. Protect it under Settings.

1. Second factor: scan the QR code with an authenticator app and enter a code. A code is then asked at every sign-in. The same code cannot be used twice.
2. Sessions: changing your password, or turning the second factor off, signs out your other sessions.
3. E-mail address: changing it asks for your password; a link valid one hour goes to the new address, and the old one is told.
4. Password: at least twelve characters; a long sentence is easier to remember than a complex word.
5. Passkeys: add one with your password, then sign in with your fingerprint, face or device PIN instead of a password and a code. Give each a name; removing one asks for your password and signs out your other sessions.

After too many wrong passwords or codes, sign-in waits for a while: this stops guessing, not you.