Password and signing in

Signing in

You sign in to the portal with your email address and password, or, if you have set up a passkey, with that. If you have turned on two-factor authentication, or your account has a passkey, signing in with a password also asks for a second step after the password: the code from your authenticator app, or the passkey.

Keep me signed in: when ticked, you stay signed in on this device for up to 30 days. Without it, for up to 10 hours. Do not tick it on a shared or public computer.
After too many failed attempts the account is locked temporarily, for at most 15 minutes. This protects against password guessing. Wait and try again, or set a new password.

Password rules

At least 12 characters.
It must not match your username or email address.
It must not be one of your last five passwords.

A good password is a long phrase used for this account only, or one generated by a password manager.

Forgotten password

On the sign-in page, click the forgotten password link, or open the Forgot password page.
Enter your email address; we send you a link.
The link is valid for 30 minutes and works once. If it has expired, ask for a new one.

Changing your password

In the Security section of the Profile page, on the Change password card, enter your current and your new password. If two-factor authentication is on, or your account has a passkey, we ask for the code or your passkey as well.

After a password change, you are signed out on every other device. If you are worried someone has had access to your account, change the password: that ends every other session.

Email address and phone number

You can change your email address and phone number on the Profile page. A new email address has to be confirmed with a link, valid for 24 hours.

We never ask for your password — not by email, not by phone, not in a support ticket. If someone asks for it in our name, do not give it, and let us know.