Keeping your account secure

Your password

Use Change password: enter your current password and a new one of at least 10 characters. Every other device is signed out. Passwords found in known data breaches are refused. A few random words make a strong password that is easy to remember, and a password manager is even better.

Two-step verification

With two-step verification, logging in needs your password and a 6-digit code, so a stolen password alone isn’t enough. Choose one of two ways:

• By email: choose Turn on next to Two-step verification. Each time you log in we email you a code. Codes work for 30 minutes.
• Authenticator app (recommended): choose Set up, scan the QR code with any authenticator app on your phone (or type the key, or copy the setup link), enter the 6-digit code it shows and choose Turn it on. The app then gives you a new code every 30 seconds, and no email is needed.

Even with the app, you can choose Email me a code instead when logging in.

Recovery codes

When you set up the authenticator app you get 10 recovery codes. Each works once, instead of an app code, if you lose your phone. Copy or Download them and keep them somewhere safe, such as your password manager; they are shown only once. New recovery codes makes a fresh set and cancels the old ones.

Recovery email

Add a second email address you control, such as a personal one. We confirm it with a code. Once added, a password reset also needs a code sent there, and if you ever lose access to your login email you can use it to get your account back. See Can’t log in?

Changing your login email

Choose Change next to Login email, enter the new address and your password, then the code we send to the new address. Your old address is told, and other devices are signed out.

Sign out other devices

Logged in on a shared or lost computer? Sign out others signs out every device except the one you are using.

Why we ask for your password again

Anything that deletes something or can’t easily be undone asks for your password first, even when you are logged in: deleting or cancelling a document, deleting a template, public link or saved block, removing contacts, removing someone from a team or leaving one, making an admin, changing seats, opening billing and some security changes. It stops someone who finds your computer unlocked from doing damage.