> ## Documentation Index
> Fetch the complete documentation index at: https://docs.brudcast.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Account security
> Two-factor authentication and backup codes, your password, signing in with Google, GitHub or Apple, and your sign-in activity.
export const DemoVideo = ({id, title, embedUrl, src, poster, duration}) => {
if (embedUrl) {
return ;
}
if (src) {
return ;
}
const label = duration ? `Video walkthrough coming soon · ${duration}` : "Video walkthrough coming soon";
return } />;
};
export const Screenshot = ({id, src, srcDark, alt, caption}) => {
if (!src) {
return } />;
}
return
{caption && {caption}}
;
};
Your account is yours, not an organization's, so everything on this page follows you into every
organization you belong to. Your account can reach every contact in those organizations, so it's
worth protecting properly.
**Before you start:** open the account menu and select **Account settings**. The **Account** page
has four tabs: **Profile** (your name, email address and phone number), **Security** (password,
two-factor authentication, connected accounts and sign-in activity), **Preferences** (light, dark
or system theme) and **Privacy** (data export and account deletion).
## Two-factor authentication
Two-factor authentication (2FA) asks for a 6-digit code after your password, so a stolen password
alone can't open your account.
| Method | How you get the code |
| --------------------- | ----------------------------------------------------------------------- |
| **Email** | Sent to your account's email address |
| **SMS** | Sent by text message to your phone number |
| **Authenticator app** | Generated by an app such as Google Authenticator or Authy, even offline |
You can turn on more than one. Having a second method means you can still sign in if you lose one.
### Set up a method
On the **Security** tab, under **Two-factor authentication**, select **Set up** next to the
method.
If you verified your email address (for **Email**) or phone number (for **SMS**) in the last 24
hours, the method turns on straight away and you're done.
In **Set up Authenticator app**, scan the QR code with your app. If you can't scan it, type the
key shown under **Or enter this key manually**. Select **Continue**.
Enter the 6-digit code from your app, or the one Brudcast sent by email or SMS. Select
**Verify**.
Brudcast shows 16 backup codes. Each works once, and they won't be shown again. Select **Copy
all** or **Download** (it saves `brudcast-backup-codes.txt`), store them somewhere safe, then
select **Done**.
The method now shows **On**. Brudcast emails you whenever a method is turned on or off.
Backup codes can't currently be entered at sign-in. Treat them as a record to keep, not as a way
back in, and turn on a second method such as email or SMS so you always have another route.
### Choose your primary method
The primary method is the one Brudcast asks for first when you sign in. The first method you set up
becomes primary. To change it, select **⋮** next to another method, then **Set as primary**.
### Replace your backup codes
Select **⋮** next to **Authenticator app**, then **Backup codes**, then **Generate new codes**. The
new set replaces every code you had before, so save it again.
### Turn off a method
Select **⋮** next to the method, then **Turn off**, and confirm. Turning off a method signs you out
on every device. If it was your primary method, another method you have on becomes primary.
### Signing in with two-factor authentication
After you enter your password, **Enter verification code** asks for a code from your primary method.
* For email and SMS, the code expires in 5 minutes. Use the resend option if it doesn't arrive.
* Under **Try another method**, you can switch to any other method you've turned on.
If you haven't turned 2FA on, you may see **Protect your account** after signing in. Select **Enable
two-factor authentication** to go to the **Security** tab, or **Remind me later**.
If you lose access to a method, sign in with another one using **Try another method**, then turn off
the lost method and set it up again on your new phone or app. If you can't use any of your methods,
contact [support@brudcast.com](mailto:support@brudcast.com).
## Your password
Under **Password** on the **Security** tab, select **Change password**, enter your **Current
password** and your **New password** twice, then select **Change Password**. A password must be at
least 8 characters, and can't match your current password or any of your three previous ones.
Brudcast signs you out on every other device and emails you to confirm.
If you've forgotten it, select **Forgot password?** on the sign-in page. Brudcast emails a 6-digit
code to your address, which expires in 10 minutes and allows 5 tries. Enter it, then set a new
password within an hour. Resetting signs you out everywhere, and also unlocks an account that was
locked after a suspicious sign-in.
## Sign in with Google, GitHub or Apple
Instead of typing a password, you can sign in with a connected provider. On the sign-in page, select
**Sign in with Google**, **Sign in with GitHub** or **Sign in with Apple**. The dashboard only shows
these buttons when third-party sign-on is available.
* If the address the provider shares matches an existing Brudcast account, the provider is connected
to it and you're signed in.
* If it's new to Brudcast, a new account is created with that email already verified. You still add a
phone number and set up your organization. See
[Create your account](/get-started/create-your-account).
To connect or disconnect one later, use **Connected accounts** on the **Security** tab. Each row
shows the provider's email address and the date it was connected. Disconnecting your only connected
account asks for your **Password** first, because your password then becomes the only way in.
An account created through a provider has no password you know. Set one with **Forgot password?** on
the sign-in page. You need a password to change your email address, disconnect your only connected
account, or delete your account.
## Sign-in activity
**Sign-in activity** on the **Security** tab lists your most recent sign-ins, newest first. Each
entry shows the browser and operating system, the IP address with the city and country when they're
known, how long ago it happened (hover for the exact date), and a **Failed** badge if the attempt
used the wrong password. Select **Show more** for older sign-ins.
There's no list of trusted devices to edit. Every successful sign-in updates Brudcast's picture of
how you normally sign in: the devices, networks and countries you use, and the times of day. A
sign-in from an unfamiliar device, IP address or country, at an unusual hour, or after many failed
attempts, is treated as unusual. Depending on how unusual it looks, Brudcast emails you "New login to
your Brudcast account", refuses the sign-in, or locks the account. A locked account shows "Your
account has been temporarily locked due to suspicious activity. Please check your email for
instructions to unlock it." Resetting your password unlocks it.
If a sign-in looks unfamiliar, change your password straight away and turn on two-factor
authentication.
## Troubleshooting
**Why:** the code was mistyped or has expired. Authenticator codes change every 30 seconds, and
need your phone's clock to be right.
**Fix:** enter the current code. If authenticator codes keep failing, turn on automatic date
and time on your phone.
**Why:** your account has no phone number.
**Fix:** add one under **Email and phone** on the **Profile** tab, and confirm it with the
6-digit code sent by text message.
**Why:** that method is already on.
**Fix:** to set it up again, for example on a new phone, turn it off first.
**Why:** the new password matches one of your three previous passwords.
**Fix:** choose a password you haven't used recently.
**Why:** a provider account can be connected to only one Brudcast account. The same applies to
GitHub and Apple.
**Fix:** disconnect it from the other Brudcast account first, or connect a different provider
account.
## Related
Export everything Brudcast holds about you, or close your account.
Sign up, verify your email and phone, and set up your organization.
Roles are set per organization, and your login can belong to several.