Security

The Security area is where you manage how you sign in. It lists every method your account has, lets you add or remove each one, and scores how well you are protected so you know what to do next. It is for every account owner, and it matters most in the first week of an account and again after any loss of a device.

Changing how you sign in is a sensitive action, so these pages ask you to confirm it is you first with a second factor you used in the last 30 minutes, and they email a security alert about the change to your verified addresses. That is expected. The one exception is the checkup, which is open to any signed-in session, because someone with no second factor needs it most.

The area has six tabs: Overview, Passkeys, Password, Two-step verification, Linked accounts and Checkup. A passkey can carry a sign-in alone. Every account also has a password, which is followed by a second step if your account has one. The authenticator app and recovery codes are that second step and its fallback. Extra sign-in steps and linked accounts are optional additions.

first step:   passkey | password | emailed link | linked accountsecond step:  passkey | authenticator app | recovery codesafety net:   second passkey, recovery codes, second verified email

The more independent ways in you hold, the less one lost device can cost you. The checkup scores exactly that.

I just signed up.

1. The Security overview: see which methods are on.
2. Passkeys: add a passkey, then a second one on another device.
3. Recovery codes: create and store a set.
4. Security checkup: confirm the score has gone up.

I lost my phone.

1. Passkeys: remove the passkey that lived on it.
2. Authenticator app: turn it off and set it up again on a new device.
3. Recovery codes: replace the set if it was stored on the phone.

The Security overview answers what each tab is, how the confirmation dialog works, what notices can appear and what to do if you sign in with a password only. Security checkup explains the 100 point score, the six checks and their weights (40, 20, 15, 10, 10 and 5), and why each check is all or nothing.

Passkeys explains a passkey on your device against one on a separate security key, and how to add, rename and remove one. Password covers setting and changing it, the rule of 12 to 256 characters, the strength meter and the breach check. Authenticator app covers setup with a QR code or setup key, using it at sign-in and turning it off. Recovery codes explains the set of ten single-use codes and why they are shown only once.

Extra sign-in steps explains two optional checks that add a step but do not make a sign-in two-factor. This feature is In development, and it is available only where your organization allows it. Linked accounts explains signing in through Google or GitHub where offered, and how to unlink. Merge accounts explains how to bring a second account of your own into this one, and warns that it cannot be undone. That page is also In development.

Have a passkey or an authenticator app ready, because the confirmation asks for one. If your account signs in with a password only, you may meet This browser is new to your account: a sign-in method can be added from a browser the account has known for 24 hours. Use a browser you already sign in from, or sign in here once with a link or code emailed to you and come back after a day; a password alone does not make a browser known.

Do I need a password? Yes. Every account has one: you choose it when you create the account, or at a Choose a password step if yours has none. A passkey is a stronger way in alongside it. See Password.

What happens if I remove my only passkey? The platform refuses to remove your only way to sign in. See Add a passkey.

Can I see my recovery codes again? No. They are shown once and only a one-way fingerprint is kept. See Recovery codes.

Is the checkup score a guarantee? No. A score of 100 does not mean you cannot be phished. See Security checkup.

Why was I emailed when I added a passkey? Changes to how you sign in always send an alert. See What a security alert email means.

It does not explain which second step to choose or how to store codes, which is advice in Security for users. It does not cover sessions and trusted browsers, which are in Devices, or the sign-in screens themselves, which are in Signing in and recovery.