Signing in, two-factor authentication, sessions and what to do about a forgotten password.
## Signing up Registration has two steps: you fill in your details, then confirm your email with the 6-digit code we send (the email also has a link that does the same). The code is valid for 30 minutes. The account is created only after that confirmation. You can also sign in with an existing account from a supported provider. Such an account has no password until you set one in Security. ## Two-factor authentication **My Account → 🛡️ Security** switches on codes from an authenticator app: 1. Confirm your current password. 2. Scan the QR code, or copy the secret into your app. 3. Enter a code to prove it works. 4. **Save the 10 recovery codes.** They are shown once, and each works once, in place of the app. From then on, signing in asks for a code. The sign-in step is valid for 5 minutes and allows 5 attempts. You can generate a new set of recovery codes, or switch two-factor off, with a valid code. ## Sessions You stay signed in for 30 days from your last use, in a cookie that JavaScript cannot read and that is only sent to this site. - Signing out ends that session. - Changing your password ends every **other** session and keeps the one you are using. - Resetting a forgotten password signs you out everywhere. ## Forgotten password **Forgot password** sends a 6-digit code valid for 15 minutes. For your safety the answer is always the same, whether or not the address is registered. ## Protection against guessing Sign-in attempts are limited per account and per address, and so are sign-ups and password resets. If you hit a limit, wait 15 minutes and try again. ## Your data **My Account → 🔐 Privacy & Data** deletes your account and everything in it. This cannot be undone.