Security
The Security page (heading "Security", subtitle "Manage two-factor authentication, active sessions and login history.") is where you harden your account and keep an eye on who's signed in. Open it from Account → Security in the sidebar.
Two-factor authentication
The Two-factor authentication card ("Add an extra layer of security using an authenticator app (optional for customers).") adds a second step to sign-in. To turn it on:
- Scan the QR code with your authenticator app, or enter the key shown under it manually.
- Enter the 6-digit code from the app and click Enable two-factor.
Save your recovery codes
Right after you enable two-factor, the card shows your one-time recovery codes: "Store these somewhere safe. Each can be used once if you lose your device." Copy them before you leave the page — they're your way back in if you lose your phone.
When two-factor is on, the card shows an Enabled badge. From then on, every sign-in asks for a code from your authenticator app — or one of your recovery codes — on a second screen, whether you used your password or Google, Envato or GitHub. See signing in.
To turn it off, type a current code into Enter a current code to disable, click Disable and confirm. The code is required so that nobody can remove the second step from a session you left open.
Tip
If you also sign in with Google, Envato or GitHub, turn on two-step verification at that provider too. The Hub's code protects your Hub account; theirs protects the account you sign in with.
Active sessions
The Active sessions card ("Devices currently signed in to your account.") lists each signed-in device by IP address and browser/device, how long ago it was active, and a This device badge on the one you're using now.
If more than one session is active, a Sign out others button appears — use it to sign out every other session while keeping this one.
Login history
The Login history card ("Your last 20 sign-ins.") lists your recent sign-ins with the IP address, device and date/time of each. Review it now and then to spot any sign-in you don't recognise. Entries are removed automatically after 180 days — see Privacy & data.
Tip
To change your password, head to your profile page — the Password card lives there, not on this page.
Was this article helpful?