Email addresses

Each row shows the address and up to two badges.

An address that is not verified shows when its code expires, in the form Code expires followed by a time in your time zone. After that time the row says That code has expired. Send a new one.

The code goes to the new address only. It is never shown on the page, so entering it proves the mailbox is yours.

Some conditions apply when you add an address:

• A session that signed in without a second factor can add an address only from a browser the account has known for 24 hours (a platform setting that defaults to 24 hours). From a newer browser the page says This browser is new to your account. You can make this change from it 24 hours after you confirm it by signing in with a link or code emailed to you, or from a browser you already use. A session that signed in with a second factor is not held back by this. A session finished with the emailed code that replaces a lost passkey has used no second factor, and on an account that has a passkey or an authenticator app the age of the browser does not help it: the page asks for a confirmed second factor first.
• Only a small number of addresses can wait for verification at once. Past that, the page says to verify or remove one first.
• The platform can refuse a request with a 429 status and a Retry-After header if you add addresses too quickly.

If a code is wrong, expired or already used, you get one generic message that the link is invalid, expired or already used. A code for another account's address is refused the same way, so you cannot verify someone else's mailbox through yours.

If the email did not arrive or the code expired, select Send a new code on that row. The page says We sent a new code. Check the spam folder first, and check that the address was typed correctly. If it was not, remove the address and add it again.

A verified address that is not primary has a Make primary button. Changing the primary address is a sensitive action, so it asks you to confirm it is you with a second factor used in the last 30 minutes. A password alone is not enough.

The steps and what follows are on Change your primary email and undo it.

Removing an address also asks you to confirm it is you with a recent second factor. You cannot remove the primary address: it has no Remove address button. Make another address primary first. An address that was your primary until a short time ago also cannot be removed while the undo link sent to it is still valid. The page then says the address can be removed once that window closes.

Under the list, a Notifications section links to Choose which emails you receive, where you can turn product updates and marketing emails on or off. Security alerts are always on. See Notifications.

• Change your primary email and undo it
• Notifications
• Security checkup, which counts a second verified address