Signing in
The password step and the Magic Code, what the two-step prompt wants, resetting a forgotten password, and what "too many attempts" actually means.
Sign in starts with your email, and the next step depends on how your account is set up. You do not have to remember which - the box works it out.
The two ways in#
If you have a password, you get a password box - and underneath it, Email me a Magic Code. That second option always works, so a forgotten password is never a dead end.
If you do not have a password, you go straight to a Magic Code: a six-digit code, emailed to you, good for a few minutes and for one use.
If you signed up with Google, GitHub or LinkedIn, use the same button. When we can see your account has a provider linked, the sign-in screen reminds you which one - so you are not left guessing why your password is not recognised.
The two-step prompt#
If you have turned on two-step verification, there is one more step after the password: a code from your authenticator app.
Lost the device? Use a recovery code instead - that is what they are for. Both are covered in two-step verification and recovery codes.
Forgotten password#
Use Email me a Magic Code to get in now, then set a new password from your settings. That is faster than a reset and leaves you signed in at the end of it.
If you would rather reset properly, the reset link on the password step emails you a code to confirm the address, then lets you choose a new password.
"Too many attempts"#
Sign-in is rate limited. Enough failed password attempts in an hour and it stops accepting them for a while, whether or not the next one would have been right.
Code requests are limited too, so asking for a Magic Code over and over will eventually stop working for the same reason.
Staying signed in#
Signing in creates a session on that browser. It persists, so you do not need to sign in daily.
You can see every device currently signed in, and sign any of them out, from who is signed in to your account.
Related#
Was this page helpful?