Account and security

Your account settings are in Settings in the app.

Passwords

• Use at least 10 characters. Common passwords, and your email address, are refused. A phrase of three or four unrelated words is strong and easy to remember. A password manager is even better.
• To change your password, open Settings and choose Change password. We email you a link to set a new one.
• Forgotten it? On the sign-in page, choose Forgotten your password? and enter your email. The link we send works for 1 hour.
• Too many wrong tries. After 10 wrong passwords or codes in a row, the account is locked for 15 minutes to stop guessing. Wait, then try again, or reset your password.

Two-factor authentication

Two-factor authentication asks for a 6-digit code from your phone when you sign in, so a stolen password alone isn't enough. We strongly recommend it, and your organisation may require it.

1. Install an authenticator app on your phone, such as 1Password, Google Authenticator or Microsoft Authenticator.
2. In the app, open Settings and choose Manage two-factor authentication.
3. Enter your password and choose Continue.
4. Under Scan this code, scan the QR code with your authenticator app. Can't scan? Type the key shown instead.
5. Enter the 6-digit code the app shows in Code from the app and choose Turn on.
6. Save your recovery codes straight away. See Recovery codes.

From then on, after your password you'll see Enter your code. Open the authenticator app and type the current code.

To turn it off, enter a current code (or a recovery code) under Turn off.

Recovery codes

• When you turn on two-factor authentication you get 10 recovery codes. Each one works once, in place of a code from your phone.
• They're shown only once. Copy them into a password manager or print them and keep them somewhere safe.
• The two-factor page shows how many you have left. Make new codes gives you a fresh 10 and cancels the old ones.

Sessions

• You stay signed in on a device for up to 14 days after signing in. Signing out ends that session straight away.
• Settings → Sessions shows how many active sign-ins you have. Choose Sign out other sessions to sign out everywhere except where you are now, for example after using a shared computer or losing a phone.
• Changing your password, or an administrator resetting your two-factor authentication, signs you out everywhere.

Google, Apple and single sign-on

• If they're available, the sign-in page shows Continue with Google, Continue with Apple or other providers.
• The first time, this creates an account, or connects to your existing account when the provider has confirmed the same email address.
• If your company has set up its own sign-in, choose Sign in with single sign-on and enter your work email. See Signing in with single sign-on.
• If you've turned on two-factor authentication here, you'll still enter a code.

Emails from us

We email you to confirm your address, reset your password, invite you to teams and, if you choose, send analytics summaries.

• If email to your address bounces (for example, the mailbox is full or no longer exists), we stop sending to it so we don't keep hitting a broken mailbox. Settings shows a notice saying so.
• If you marked one of our emails as spam, we stop sending analytics summaries. Account and security emails, such as password resets, still arrive. Settings shows a notice about this too.
• To get emails again, fix the mailbox if needed, then contact us from that address and we'll turn email back on.
• Not getting an email you expect? Check junk and spam first, and check the address shown under Settings → Account.

If you can't sign in