Passkeys, two-factor, and signed-in devices

Everything on this page lives on the web under Settings → Account & Security, which also has Change Password, Change Email, and Delete Account. Each person manages their own account.

Changes to passkeys and two-factor ask for your current password. Adding or removing a passkey, or turning two-factor off, also sends a security email to your address, so you'll know if someone else tries.

Two-factor adds a six-digit code from an authenticator app (Google Authenticator, 1Password, Authy, or similar) to your password, so a stolen password on its own isn't enough.

1. Under Two-Factor Authentication, tap Enable two-factor, confirm your password, and tap Continue.
2. Scan the QR code with your authenticator app, or type in the key shown under it.
3. Save your ten backup codes with Copy or Download, somewhere other than your phone, and tick I've saved my backup codes.
4. Enter the six-digit code from the app and tap Verify & enable.

From then on, signing in on the web asks for a code after your password. Tick Trust this device for 30 days on computers you use every day. If your phone isn't to hand, choose Use a backup code instead; each backup code works once. Ten wrong codes in a row pause code entry for 15 minutes.

Keep your backup codes safe. If you lose your authenticator app, they're the only way back into your account. You can make a fresh set any time with Regenerate backup codes (the old ones stop working), or switch two-factor off with Disable 2FA.

If you use the mobile app: the Chickadee Bandit app can't sign in to an account that has two-factor turned on. It shows "Sign in on the web to continue." Two-factor protects your web sign-ins; decide whether to turn it on knowing the app won't sign in while it's on.

A passkey lets you sign in with your fingerprint, face, or device PIN instead of typing a password. It's stored by your phone, computer, or password manager, and it can't be phished.

1. Under Passkeys, enter your password in the confirmation field.
2. Optionally give it a name, like "My laptop", so you can tell your passkeys apart later.
3. Tap Add passkey and follow your device's prompt.

To use it, choose Sign in with a passkey on the sign-in page, or pick it from the suggestions when you tap the email field. Passkeys work in web browsers, not in the mobile app. To remove one, enter your password and tap Remove next to it. If a browser doesn't support passkeys, the section says so.

Signed-in Devices lists every browser and phone signed in to your account, with when each was last active and its internet address. The one you're using is marked This device.

• Revoke signs out one other device.
• Sign out all other devices signs out everything except the one you're on, and also makes every trusted device ask for a two-factor code again.
• Changing your password signs out every other device too.

Sign-ins expire after seven days without use. Shared family tablets aren't listed here, because they don't sign in as a person; an admin manages them under Settings → Shared Devices.

1. Change your password. That signs out every other device.
2. Check Passkeys and remove any you don't recognise.
3. Turn on two-factor if it isn't on, or regenerate your backup codes if it is.
4. If you can't sign in at all, use Forgot your password? on the sign-in page, or contact us.