# Security

The account **Security** page protects your sign-in. It has two cards: **Change password** and **Two-factor sign-in**.

## Before you start [#before-you-start]

- To open the page, click your avatar at the top right, click **User settings**, and then click **Security** in the sidebar.
- The settings apply to your account in all workspaces.

## Change password [#change-password]

The **Change password** card changes the password you sign in with. The new password needs 8 or more characters, with upper case and lower case letters, a number and a symbol.

1. In **Current password**, enter your password.
2. In **New password**, enter the new password.
3. In **Confirm new password**, enter the new password again.
4. Click **Save new password**.

The message **Password changed** confirms it. If the two new passwords are not the same, the form shows **The two passwords do not match**.

### Forgot your password [#forgot-your-password]

If you cannot sign in, you cannot open the **Security** page. Use the password reset link on the sign-in page instead.

1. On the sign-in page, click **Forgot password?**.
2. Enter the email address of your account.
3. Open the reset email and click the link.
4. Enter a new password.

## Two-factor sign-in [#two-factor-sign-in]

Two-factor sign-in adds a second step to every sign-in. After your password, you enter a 6-digit code from an authenticator app on your phone. Examples of authenticator apps are Google Authenticator, Authy and 1Password. The code keeps your account safe even if somebody learns your password.

The **Two-factor sign-in** card shows the chip **On** or **Off**. When it is on, the card says **Two-factor authentication is on** and **Enabled on** with the date.

### Turn on two-factor sign-in [#turn-on-two-factor-sign-in]

1. Click **Turn on two-factor sign-in**.
2. Scan the QR code with your authenticator app. Or enter the code that shows below the QR code into the app.
3. Enter the 6-digit code from your app.
4. Click **Turn on**.

The message **Two-factor sign-in is on** confirms it. Then the dialog **Save your backup codes** opens.

### Backup codes [#backup-codes]

Backup codes let you sign in if you lose your phone. Each code works only once.

1. In the **Save your backup codes** dialog, click **Download**, or copy each code. The message **Backup codes downloaded** confirms the download.
2. Keep the codes in a safe place, for example a password manager.
3. Click **Done**.

<Callout type="warn">
  If you lose your phone and your backup codes, you cannot sign in. Save the backup codes before you click **Done**, because the dialog shows them only one time.
</Callout>

### Turn off two-factor sign-in [#turn-off-two-factor-sign-in]

1. Click **Turn off two-factor sign-in**.
2. Enter a code from your authenticator app, or a backup code.
3. Click **Turn off**.

The message **Two-factor sign-in is off** confirms it.

## Troubleshooting [#troubleshooting]

### Why does my authenticator code not work? [#why-does-my-authenticator-code-not-work]

Make sure that the time on your phone is correct, because the codes change after a short time. Enter the newest code. If you lost your phone, use a backup code.

### Why does the form say The two passwords do not match? [#why-does-the-form-say-the-two-passwords-do-not-match]

The values in **New password** and **Confirm new password** are not the same. Enter the same password in both fields.

### Where can I see my active sessions? [#where-can-i-see-my-active-sessions]

The **Security** page does not show sessions. To protect your account, change your password and turn on two-factor sign-in.

## Related [#related]

- [Profile](/account/profile) - your name and time zone
- [Connected apps](/account/connected-apps) - apps that can act for you
- [Data and privacy](/account/data-and-privacy) - delete your account