How do I change my password and turn on two-step verification?

Opening Security

Go to Settings > Security, or click Security in the account menu (the user icon, top right). The window has three tabs: Password, Authenticator app, and Trusted devices. Every staff member can open it for their own account.

How login codes work

Storeep asks for a 6-digit code so that a stolen password alone cannot open your account:

• Logging in from a new device: after your password, the Confirm it's you page asks for the code. Logging in with Google or Apple does not ask, because they already check it is you.
• Changing your email or password: a window asks for the code before the change is saved.

The code is sent to your email, together with the device and IP address that asked for it. It works for 10 minutes and stops after 5 wrong tries. Once you turn on an authenticator app, the code comes from the app instead. If you get a code you did not ask for, do not use it and change your password.

Changing your password

1. Open the Password tab.
2. Fill in Current password, New password, and Confirm new password. The new password needs at least 8 characters, with one uppercase letter, one lowercase letter, and one number, and it must be different from the current one. A strength bar shows how strong it is as you type.
3. Click Change password and enter the 6-digit code.

You stay signed in on your other devices. To sign one out, use Settings > Logins, see Active logins and banned sessions. Every trusted device asks for a code again at its next login.

Turning on an authenticator app

An authenticator app on your phone shows a new 6-digit code every 30 seconds. You do not wait for an email, and it still works when you cannot open your inbox.

1. Use an authenticator app on your phone, for example Apple Passwords (built into iPhone), Google Authenticator, or Microsoft Authenticator.
2. Open the Authenticator app tab and click Set up.
3. Scan the QR code with the app, or type the key shown under it. On the phone itself, tap Add to an authenticator app on this device instead.
4. Enter the 6-digit code the app shows. If it is refused, make sure the time on your phone is set automatically.
5. Save your 10 backup codes with Copy or Download (on a phone, Download opens the share menu so you can save the file), then click Done. They are shown only once.

From then on, login codes and the codes for changing your email or password come from the app. Every trusted device asks for a code again, so your next login proves the app works.

Backup codes

• Each backup code works once. When your phone is not with you, click Use a backup code on the Confirm it's you page and type one.
• The tab shows how many codes are left. Click New backup codes and enter a code from the app to get a fresh set. The old ones stop working.
• Without your phone, you can also click Email me a code instead on the login page.

Turning off the app or changing phones

Click Turn off on the Authenticator app tab and enter a code from the app or one of your backup codes. Codes are then sent by email again. To move to a new phone, turn the app off, then set it up again on the new phone.

Trusted devices

When you tick Trust this device for 30 days on the login page, that browser skips the code for 30 days. The Trusted devices tab lists each one with the date, IP address, country, browser, system, and the day the trust ends.

• To make a device ask for a code again, click the trash button on its row, or tick several and choose Stop trusting.
• Changing your password or your email removes every trusted device at once.
• Trusting a device does not keep you signed in. That is what Remember me does on the login page.