Change your primary email and undo it
Make another verified address your primary one, what the platform does when you do, and how the owner of the old address can undo a change they did not make.
On this page
Your primary address is the one your account is known by. Changing it is a sensitive action, because whoever controls the primary address can receive sign-in links and start a recovery. The platform therefore asks you to confirm it is you, ends your other sessions, tells every verified address, and gives the old address a way to undo the change.
Before you start#
The new address must already be on your account and Verified. See Email addresses. An address that is Not verified has no Make primary button, and the platform refuses the change with a message that an email must be verified before it can become primary.
Make an address primary#
- Open Profile. The Email addresses section is on the same page.
- On the row of the verified address, select Make primary.
- If the page asks, confirm it is you. The dialog is titled Confirm it is you and says it needs a second factor used in the last 30 minutes. Use a passkey with Use a passkey, or type your authenticator code and select Confirm. If you have a linked account, a Continue with button may be offered. If your session was opened with a passkey or with a provider's second factor, Other ways to confirm also offers your account password: type it under Account password and select Confirm with password. A session that started with a password, an email link or recovery is not offered the password. Nothing has changed until you confirm.
- The page says Primary address changed. and adds Your previous primary address was sent a link to undo this change, if it was verified.
If the dialog says No second factor on this account can confirm this here. Sign in again with a passkey or an authenticator app., your session cannot satisfy the check. Sign in again with a passkey or an authenticator app, or set one up first. See Security overview.
What the platform does#
- Your other signed-in sessions end. The one you are using stays signed in, and applications those other sessions signed in to lose access.
- A security email saying the primary email changed goes to every verified address on the account, new and old.
- The old primary address also gets an email titled Your primary email was changed. It says the change signed you out of every device and has a Revert the change button. The link in it expires after 24 hours (a platform setting can make that shorter, never longer), and the email prints the exact time.
The undo email is sent only if the old address was verified. Like the other emails from identity, it is written in the language saved in your profile (English, French or Spanish), and the titles quoted here are the English ones. If sending fails, it is not retried, so the notice to every address is the dependable signal.
Undo a change you did not make#
You do this from the old address's mailbox. You do not need to be signed in, which matters because the change ended your sessions.
- Open the email Your primary email was changed and select Revert the change.
- The page is titled Undo an email change and says Undo the change and use the old address again. It also says Opening this page changes nothing. Only the button below does.
- Select Undo the change.
- The page says The change was undone. Secure your account if you did not make it. and offers Secure your account, which starts a recovery.
Undoing the change makes the old address primary again and ends every session on the account, including any held by whoever made the change. Treat it as a sign of a possible takeover: use Secure your account to start recovery, and review your passkeys and password afterwards.
A link that has expired, was used, or was replaced shows This link is not valid any more. A successful undo cancels any other undo link still outstanding, so a link in the hands of an attacker cannot flip the primary back again.
While the undo link is live#
For as long as the link is valid (up to 24 hours), the old address cannot be removed from the account. Trying says that the address has a pending primary-email revert and can be removed once that window closes. This stops someone who has taken over a session from deleting the address and the undo link with it.