Password and 2FA

Settings → Security. Three cards, in the order of what they protect: the password that opens the account, the second factor that backs it up, and the list of devices currently signed in.

Change your password

The three fields are the current password, the new one, and a confirmation. A new password is at least 12 characters and at most 200; every character is accepted, and no composition rule asks for a digit or a symbol.

Length alone is not enough. The API scores the password and refuses one that is guessable even when it is long enough, naming the part that gives it away: a common word, a keyboard walk, a date, a repeated fragment. motdepasse12345 is fifteen characters and is turned down.

Changing the password revokes every other session, on every device, and keeps the one you are using. That is the fastest way to end a session you are not sure about.

Two-factor authentication

A second factor is a six-digit code from an authenticator app, asked for after the password at every sign-in. It is off until you turn it on.

1. Press Enable. A QR code appears, with the same key printed as text underneath for an app that cannot scan.

2. Scan it, then type the current six-digit code into the field and confirm. The code is checked before anything is turned on, so a mis-scanned QR fails here rather than at your next sign-in.

3. Ten recovery codes appear, in the shape abcd-2345. Copy them, or download them as badlen-codes-recuperation.txt. The button that closes the panel stays disabled until you tick the box saying you have put them somewhere safe.

The codes are shown once

Closing that panel destroys the only copy. If you lose them, Regenerate the codes on the same card creates a fresh set. It asks for a current six-digit code first, or for one of the codes being replaced when your authenticator is what is gone, because a fresh set is itself a second factor; the old set stops working the moment the new one is drawn.

Each recovery code works once, in place of the app, and the card says how many are left. Sign in with one when your phone is gone, then regenerate the set.

A code from the app works once too: signing in again within the thirty seconds it stays on screen, the sign-in says it has just been used and waits for the next one.

To turn 2FA off, press Disable and enter a current code. The stored secret and any unused recovery codes are erased with it.

When no code can be checked

An instance restored under a different SECRET_ENCRYPTION_KEY holds a secret it cannot read, so no code could ever pass. That one case asks for your password instead of a code, and Restoring under another key is the page for it.

Connected devices

Every signed-in session is listed with its browser, its IP address, the day it started, the day it was last used and the day it expires. A session renews itself about every quarter of an hour while it is being used, and the expiry moves with it: seven days after the last use, unless the instance was configured otherwise. Your own is marked current session.

Revoke ends one of them. Sign out the others ends all but yours in one press. Neither asks for a password, because both are reachable only from inside your own session.

A session opened with Remember me unticked stays a browser session through every renewal and a password change: closing the browser ends it. And a code never passes twice, even sent twice at the same instant: an authenticator code and a recovery code are each spent by the first request that presents them.