Secure your account

The Secure your account page, where recovery lets you set a new password, authenticator app and passkeys before you finish.

On this page

When recovery goes ahead, you land on a page titled Secure your account. It says Recovery lets you set new sign-in methods. Review each one, then finish. This is where you replace what you lost. You reach it by selecting Continue recovery on the recovery link page, after any waiting period has ended.

The session you are in at this point is a limited one. As the recovery email says, recovery signs you out everywhere and limits the new session to your security settings until you set your sign-in methods again. You can do nothing else with this session. It is for this page.

Password#

The section is Password. Recovery finishes only on a password: the account must have one, so save a new one here unless the account already holds one you want to keep. A passkey alone no longer finishes recovery. When the account already has a password the form starts closed under Change your password; select it to open the form. When the account has none, the form is open.

Type a new password in New password. The hint says Use a long passphrase. Pasting from a password manager works.
Type it again in Confirm the new password. If the two differ the page says The two entries do not match.
Select Save new password. The page says Password saved.

A password that does not meet the requirements is refused with That password does not meet the requirements.

Authenticator app#

The section is Authenticator app. Use it to set up a new app, or to remove one that is no longer yours.

Select Set up a new authenticator app. The page shows a QR code.
Scan the QR code with your authenticator app. If you cannot scan it, select Can't scan? Enter this key and type the key it shows, which is written in groups of four characters. The page says Scan the key with your authenticator app, then enter the code it shows.
Type the six digit code in Code from your authenticator app and select Confirm the code.
The page says An authenticator app is set up. and shows a list under Recovery codes, with Save these somewhere safe. Each one works once. Save them before you leave the page.

If an authenticator app is set up already, the page says so and offers Remove the authenticator app.

Passkeys#

The section is Passkeys. It lists the passkeys on the account, each with the date it was added (for example Added 2026-10-14 09:30 UTC, always in UTC) and a Remove button, or says No passkeys are registered. Remove any passkey on a device you have lost, or that you do not recognise.

To add one, select Add a passkey and follow your browser's prompt. The page says Passkey added. and the new passkey appears in the list, named after the browser you used with (added in recovery) after it, for example Firefox on Linux (added in recovery), so that you can tell it apart later. An account holds a limited number of passkeys (20 unless the operator changed it); at the limit the page explains that the account already has the most passkeys it can hold, and you remove one you no longer use first. If you close the prompt the page says No passkey was created. You can try again. Adding a passkey signs out every other session on the account and gives this browser a fresh limited session, the same as the other changes on this page. See Security and passkeys.

The authenticator app you had before#

If an authenticator app was set up before the recovery and is still there, a box appears: I still have the authenticator app that was set up before, and I want to keep it. Tick it only if that is true. If you lost the device, remove the app instead and set up a new one.

The passkeys you had before#

If a passkey was on the account before the recovery began, a box appears: I recognise these passkeys and want to keep them. Tick it only if every passkey in the list is yours. Anyone who could read your email could have started a recovery and added a passkey of their own, so remove any passkey you do not recognise instead. A passkey you add on this page does not need the box.

Before you can finish#

The page refuses to finish when it would leave the account without a way in or with an old app still active:

What you see	What to do
Set a password before finishing.	Save a new password, then select finish again. A passkey alone no longer finishes recovery.
An authenticator app from before the recovery is still set up. Remove it, or say you still have it.	Remove it, or tick the box that says you still have it.
A passkey from before the recovery is still on the account. Remove any you do not recognise, or say you recognise them.	Remove the passkeys you do not recognise, or tick the box that says you recognise them.
This recovery session has ended. Start again.	The recovery session is no longer valid. Begin again on Start a recovery.

When you are done with all the sections, select Finish recovery, the only highlighted button on the page. Under it the page says Finishing ends all your other sessions, then you sign in again. See Finish recovery.

Advice#

Set the password, which is required, and do the other sections that apply to you. If you lost a device, remove its passkeys, so that nobody who finds it can use them.
Use a password manager. A long passphrase is better than a short complicated password.
Keep the recovery codes apart from the device that holds your authenticator app.