Signing in and second factors
Ways to sign in
Section titled “Ways to sign in”- Email and password. Passwords are 12 to 72 characters, with an upper-case letter, a lower-case letter, a number and a symbol.
- Google, GitHub or Microsoft. Linking one to an existing account requires the provider to vouch for the same, verified address.
- Your organization’s single sign-on, when it has one: type your work address and you are sent to your provider. See single sign-on.
A new account is confirmed with a six-digit code sent to its address.
Second factors
Section titled “Second factors”A password sign-in always asks for a second step: a code emailed to you, unless the device is trusted, or a stronger factor if you have one.
| Factor | Notes |
|---|---|
| Emailed code | Always available. Does not satisfy an organization that requires MFA. |
| Authenticator app | TOTP. Enrolling gives you ten recovery codes: store them; each works once. |
| Security key | FIDO2 / WebAuthn — a hardware key or a passkey on your device. |
| Recovery code | When you have lost your authenticator. Does not satisfy an organization that requires MFA. |
Remember this device skips the second step on that browser for 30 days — except where an organization you belong to requires MFA and you have a strong factor: then you are always asked for it.
An organization that requires MFA counts only an authenticator app or a security key.
Sensitive actions — changing your password or address, deleting your account, creating API or provisioning tokens, changing an organization’s security policy — ask you to prove it is you again.
How long you stay signed in
Section titled “How long you stay signed in”| Sign-in | Session lasts |
|---|---|
| Password | 1 day |
| Password, with Keep me signed in | 30 days |
| Google, GitHub, Microsoft, or your organization’s SSO | 7 days |
An organization’s policy can shorten that: see security policy.
Locked out
Section titled “Locked out”After repeated failed sign-ins an account is locked for a while. Forgot password sends a reset link (three per ten minutes); resetting signs you out everywhere and forgets your trusted devices.