> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Two-Step Sign-in and Passkeys

Your AutoPhish account contains sensitive information about your organisation, so it is protected with two-step sign-in by default. You can make signing in even safer – and faster – with a passkey.

## Where to find it

Go to **Settings → Sign-in & Security**. The section **How you sign in** shows whether two-step sign-in is on and how many passkeys you have registered.

![Settings - Sign-in & Security](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/signin-security-settings_1lc874t.png)


## Two-step sign-in (e-mail code)

Two-step sign-in is **on for every account by default**. After entering your password, AutoPhish e-mails you a 6-digit code. Administrators may know this as MFA (multi-factor authentication).

- The code is valid for **10 minutes**.
- **Resend code** invalidates all earlier codes – always use the newest e-mail.
- After 5 wrong entries the code becomes invalid and you need to request a new one. After 10 failed attempts in a row, two-step sign-in is locked for 15 minutes.
- If you wait more than 30 minutes, you are asked to enter your password again.

Code not arriving? Check your spam folder and make sure your mail system accepts e-mails from AutoPhish.

## Passkeys – the recommended way

A passkey lets you sign in with your fingerprint, face or device PIN. Passkeys are resistant to phishing and replace both the password and the e-mail code.

**Add a passkey**

1. Go to **Settings → Sign-in & Security → Passkeys**.
2. Click **Add passkey** and confirm with your **Current password**.
3. Click **Continue** and follow your device's prompt.

Add a passkey on each device you use regularly. Right after signing in, AutoPhish may also offer **Set up passkey** – choose **Not now** to hide the prompt for 30 days.

**Sign in with a passkey:** On the login page, click **Sign in with passkey** and confirm on your device.

**Rename or remove:** Use **Rename** to give a passkey a recognisable name (e.g. "Work laptop"). **Remove** deletes it after you confirm your password.

## Change your password

Under **Change Password**, enter your current password and the new one twice, then click **Update Password**. Passwords need at least 8 characters including an uppercase letter, a lowercase letter, a number and a special character.

## Turn two-step sign-in off (not recommended)

Open **Turn off two-step sign-in (not recommended)**, enter your current password and confirm. You can switch it back on anytime with **Turn on two-step sign-in**.

Two-step sign-in is a personal setting. There is currently no company-wide setting that enforces it for all team members, so we recommend agreeing on it within your team.

## Lost access?

- **Lost the device with your passkey:** Sign in with your password and the e-mail code, then remove the old passkey and add a new one.
- **Forgot your password:** Click **Forgot Password?** on the login page and follow the link in the e-mail. Resetting your password signs you out on all devices. Two-step sign-in and passkeys stay active.
- **No access to your e-mail inbox either:** Contact AutoPhish support.

## Good to know

- Limit Owner and Admin roles to people who need them (see "Manage Users, Roles & Multi-Company").
- Never share sign-in codes with anyone.