Skip to main content

Logging in and security

Logging in​

Click Log in and enter your email address and password. You stay logged in on that device until you log out, or for 30 days after you last used the site.

After several wrong passwords in a row, the site asks you to wait a few minutes: "Too many attempts. Try again later."

Forgotten your password​

On the login page, click Forgot your password?, enter your email address and click Send reset link. Open the link in the email within an hour, and choose a New password of at least 12 characters.

Changing your password logs you out on every other device, and we email you to say it was changed.

To change your password while logged in, go to Account › Security and click Email me a reset link.

Two-factor login​

Two-factor login asks for a code from an authenticator app, such as 1Password, Google Authenticator or Authy, after your password. Someone who learns your password still can't log in without your phone. We recommend it.

Turning it on​

  1. Go to Account › Security and click Turn on, under Two-factor login.
  2. Confirm your password.
  3. In your authenticator app, add an account and scan the QR code on the page (or type the Setup key).
  4. Type the 6-digit code the app shows and click Turn on two-factor login.
  5. Save your recovery codes: 10 codes, each of which logs you in once if you lose your phone. Copy or Download them, tick I've saved my recovery codes, and click Done. We won't show them again.

Turning two-factor login on or off signs out your other devices, and we email you about it.

Logging in with it​

After your password, enter the 6-digit code from your app. Each code works once; if one doesn't work, try the newest.

Lost your phone? Enter one of your recovery codes instead. The site tells you how many are left. When you're down to a few, create new ones in Account › Security (Create new recovery codes; the old ones stop working).

To turn it off, click Turn off and enter your password and a code from your app, or a recovery code.

Devices​

Account › Devices lists where you're logged in: the browser and device, when it was last active, and when you logged in.

  • Sign out logs out one device; Sign out all other devices logs out everywhere but here. Signed-out devices lose access within 15 minutes.
  • If you see a device you don't recognize, sign it out, then change your password.