Account security

Creating an account

All you need is an email address. Choose Create account, enter your email, and open the link we send you within 30 minutes. The link works once. If your email already has an account, we send a sign-in code instead and take you to sign-in.

A security check may appear when you request an email. It completes in the background where possible and closes after sending. Checking your email address, using a passkey, entering an email code and two-step verification do not require another check.

Email codes

You sign in with a one-time code sent to your email. There is no password to leak or reuse. Email codes always work, even after you add a passkey. If your email has no account yet, sign-in asks you to register without sending an email.

Two-step verification

Turn it on in Account → Security with an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password. Scan the QR code, enter the first code to confirm, then save the ten backup codes shown. Each backup code works once.

We ask for the authenticator code at sign-in, right after the email code and before any session exists. We chose this point on purpose: a session made after the email code alone could already read your billing details or change settings, so asking later (for example only when opening a browser) would leave those unprotected. Asking once at sign-in protects everything, and keeps opening a browser fast.

• Choose Trust this device for 30 days only on a device you alone use. You still need an email code or a passkey.
• After five wrong codes the sign-in starts over; after ten, sign-in is locked for 15 minutes.
• If the code is rejected, check that your phone sets its clock automatically.
• Turning it off needs an authenticator or backup code. Replacing backup codes needs an authenticator code.
• Lost your phone and your backup codes? Contact support from your sign-in email; after we confirm it is you, we can reset it.

Passkeys

Add a passkey in Account → Security. When you sign in, we offer it instead of an email code: confirm with your fingerprint, face or device PIN and you are in. Because a passkey already proves two things (the device you hold and you), it does not ask for the authenticator code. You can still choose to get an email code instead.

Signing out

Sign out ends the session on this device. Sign out everywhere ends every session on every device and disconnects any open live views.