A few steps keep your account secure.
Passwords & sign-in
- Use a strong, unique password, or sign in with Google.
- Sessions are cookie-based; sign out on shared devices.
Two-factor authentication (2FA)
- Enable TOTP-based 2FA in Settings — scan the QR code with an authenticator app.
- Once enabled, every login (password and Google) is challenged for a 6-digit code.
- 2FA is enforced server-side, so a valid session isn't granted until the code is verified.
Lost your phone? Three ways in
- The code from your authenticator app — the usual way.
- Send a code to my email instead — on the code screen. It expires in 10 minutes, and only the newest one works.
- Use a backup code — one of the eight codes shown when you turned 2FA on. Each works once, and dashes and capitals don't matter. You are emailed every time one is used.
Settings → Security shows how many backup codes you have left. Make new backup codes there (it asks for your authenticator's code) whenever you run low or think a code was seen by someone else — the old ones stop working straight away.
Codes shown before 26 September 2026 were accepted by nothing at sign-in; they work now, so if you saved them, you do not need new ones.
“Too many requests” on the code screen
Code entry is limited to 10 attempts every 15 minutes per account, so nobody can sit and guess six digits. Entering the right code clears the count immediately — a few typos on the way in cost you nothing.
- If you hit the limit, wait for the window to pass and try again; nothing is locked permanently.
- If your authenticator app's codes are being rejected, its clock has usually drifted — resync the time in the app, or use Send a code to my email instead or a backup code.
- Seeing this without having tried to sign in is worth telling us about — contact us.
“Google hasn't confirmed that email address”
We only accept a Google sign-in when Google itself reports the address as confirmed, because that address is what links the sign-in to your account. If you see this, confirm the address in your Google account, or sign in with your email and password instead — your data is the same account either way.