Account and security

Everything here lives in Settings, then Account.

Your email address

Your email is used to log in and to send you notices. To change it, enter the new address and your password. We send a link to the new address, and the change happens only when you open it. Asking to change your email may ask you to confirm your password again first.

Password rules

• At least 10 characters, and no more than 200.
• Not one of the very common passwords (such as "password123" or "qwerty").
• A long phrase is better than a short, complicated one. A password manager is better still.

To change it, enter your current password, then the new one twice. If you forget your password, use Forgot password on the log in page and we will email you a link.

Two factor sign in

Two factor adds a second step when you log in: a six-digit code from an app on your phone. Even if someone learns your password, they cannot get in without your phone. We strongly recommend it.

Turn it on

1. Install an authenticator app on your phone (for example Google Authenticator, Microsoft Authenticator, Authy or 1Password).
2. In Settings, then Account, find Security and press Set up two factor. You may be asked for your password first.
3. Scan the QR code with the app. If you cannot scan it, type the key shown on screen into the app instead.
4. Type the six-digit code the app shows and confirm.
5. Save your recovery codes. They are shown only once.

Recovery codes

If you lose your phone, a recovery code lets you in. Each code works once. Keep them somewhere safe and separate from your phone, such as a password manager or a printed sheet. You can create a fresh set from the same Security section, which cancels the old ones. The page tells you how many you have left.

Logging in with two factor

After your password, type the current code from your app, or one of your recovery codes.

Turn it off

Press Turn off in the Security section. Moderators and admins cannot turn it off, because staff accounts must keep it on.

Sessions

You stay logged in on each device until you choose Log out from the account menu. To sign out of every browser and device at once, including this one, open Settings, then Account, find Log out everywhere under Security and confirm. Use it if you lost a phone or used a shared computer. If you think someone else has your password, change it straight away and turn on two factor. A moderator can also end all of your sessions if you contact the team.

Export your data

Press Export my data to download a file with your profile, posts, articles, settings and a list of your uploads. Passwords and security secrets are never included. You may be asked to confirm your password first.

Delete your account

In the Danger zone, press delete, type DELETE and confirm with your password. Your profile and personal data are removed, and your posts stay but are shown as written by a deleted member. This cannot be undone, so export your data first if you want a copy.