Account security

The Security and Sessions tabs of your profile protect your account. Here you change your password, turn on two-factor authentication so that signing in also needs a code from your phone, and sign out of other browsers and devices.

Use them when you want a stronger password, when you set up a new phone, or when you suspect someone else is signed in to your account.

How to open your profile

1. Click your name in the top bar.
2. Click My profile.
3. Select the Security or Sessions tab.

How to change your password

1. In the Security tab, go to Change password.
2. Enter your Current password.
3. Enter the New password and repeat it in Confirm new password.
4. Click Change password.

The new password must have at least 12 characters with upper and lower case letters and a number, and must differ from the current one.

How to enable two-factor authentication

You need an authenticator app on your phone, such as Google Authenticator.

1. In the Security tab, under Two-factor authentication, click Enable two-factor.
2. Scan the QR code with your authenticator app. If the app cannot scan it, type the Manual entry key instead.
3. Save the Recovery Codes in a safe place. They are shown only now.
4. In Code 1 — shown now, enter the code your app shows.
5. Wait for the app to show the next code and enter it in Code 2 — the next one.
6. Click Enable 2FA.

Note

For some roles, two-factor authentication is required and the setup cannot be skipped. For other roles, Skip for now is available and you can enable it later from your profile.

Signing in with two-factor authentication

After you enter your password, the Two-Factor Verification screen asks for the Verification Code from your app. Enter it and click Verify.

If you lost your phone, click Or use a recovery code and enter one of your recovery codes. Each recovery code works only once.

Caution

After too many wrong codes, you must wait a minute before trying again.

How to manage two-factor authentication

1. In the Security tab, click Manage two-factor.
2. The Security Settings page shows the status and how many unused recovery codes you have.

To get new recovery codes:

1. In the recovery codes section, enter the current code from your app.
2. Click Regenerate.
3. Save the new codes. The old codes stop working.

To disable two-factor authentication:

1. Under Disable Two-Factor Authentication, enter the current code from your app.
2. Click Disable 2FA and confirm.

Caution

Disable it only to switch to a new authenticator app. Until you set it up again, your account is protected by your password only.

How to sign out other sessions

The Sessions tab lists Signed-in sessions: the device, IP address and last activity of each one. Your current session is marked This device.

1. Click Sign out other sessions.
2. Enter your Password.
3. Click Sign out.

All other browsers and devices are signed out; your current session stays signed in.

Who can do this

Every signed-in user can manage the security of their own account.