Account security
Set your password, turn on two-factor authentication, add passkeys, and review the browsers signed in to your account.
Account security
The Security page manages the credentials that protect your personal account. Open it from Settings › Account › Security. Everything here is personal to you — it's the same page whether you own the workspace or are a member.
It covers four things: your password, two-factor authentication, passkeys, and your active browser sessions.
Password
The password section shows whether a password is set. To change it, enter your current password, then your new password twice, and choose Update password.
If you signed up without a password — for example through a social login — you'll see a Set password form instead, where you choose a new password to add one.
Two-factor authentication
Two-factor authentication adds a second step at sign-in using an authenticator app on your phone (any TOTP app works). It's the single most effective thing you can do to protect your account, and we recommend turning it on before you invite teammates.
To turn it on:
- Choose Enable two-factor authentication.
- Scan the QR code with your authenticator app, or type in the manual entry key if you can't scan.
- Enter the six-digit code from the app and choose Confirm two-factor authentication.
Once it's on, you'll be shown a set of recovery codes. Save these somewhere safe — they're your way back in if you lose your phone, and they won't be shown again. You can Regenerate recovery codes or Disable two-factor later; both ask for your password first.
Passkeys
Passkeys let you sign in without a password, using your device's own authentication — Face ID, Touch ID, Windows Hello, or a hardware security key.
To add one, type a name you'll recognise (for example "MacBook" or "Work phone"), choose Add passkey, and follow your browser's prompt. Each passkey in the list shows when it was last used, and you can Delete one at any time.
If your browser doesn't support passkeys, the form is disabled and tells you so.
Browser sessions
This section lists the browsers currently signed in to your account, with the browser, platform, IP address, and when each was last active. Your current device is marked This device.
If you see a session you don't recognise — or you've signed in on a shared or lost device — choose Log out other sessions. It signs out every session except the one you're using now, and asks for your password to confirm.
What's next
- Settings overview — the map of everything else you can configure
Was this helpful?