Skip to main content
Open Account settings → Security. The page has, in order: Password, Two-Factor Authentication, Your devices and Security activity. Each section has its own action; there’s no page-wide Save. When one of your organizations requires something of you, such as a new password or two-factor authentication, a banner at the top of the page says what to do.

​
Password

Enter your Current password, then the New password, and again under Confirm new password. Choose Change password.
  • Every password must have at least 8 characters, can’t be one that has appeared in a known data breach, and can’t be your current password.
  • Your organizations can add rules, such as a longer minimum or required character types. If you belong to several organizations, the strictest rules apply, and the message says which organization requires what.
  • Sign out other sessions is on by default: your other devices are signed out, and this one stays signed in. If one of your organizations requires it, it can’t be turned off.
  • An organization can make passwords expire. Weelkit then asks you to choose a new one when you sign in. Accounts that sign in only with Google or GitHub have no password and never expire.
Forgot it? Use Forgot Password? on the sign-in page. See Sign in and organizations.

​
Two-factor authentication

Two-factor authentication asks for a 6-digit code from an authenticator app (such as 1Password, Google Authenticator or Microsoft Authenticator) every time you sign in, including with Google or GitHub.
1

Turn it on

Turn on Enable Two-Factor Authentication. In Set Up Two-Factor Authentication, scan the QR code with your authenticator app, or enter the key it shows by hand. Enter the code your app shows and choose Verify & Enable.
2

Save your recovery codes

Weelkit shows your recovery codes once. Choose Copy All and save them somewhere safe: each one works once, in place of an authenticator code, if you lose your phone. Then choose Done.
  • The section shows how many recovery codes you have left. Generate New Recovery Codes replaces all of them.
  • To turn two-factor authentication off, turn off the switch and choose Turn off. To move to a new authenticator app, turn it off and on again.
  • If your organization requires two-factor authentication, Google or GitHub sign-in alone doesn’t satisfy it: you need Weelkit’s authenticator code. When a requirement starts, a banner shows the date by which to set it up.
All of these ask you to confirm it’s you first.

​
Your devices

Your devices lists every browser where you’re signed in. This device is first, marked Active now. For each one you see:
  • the browser and version, operating system and device type;
  • how you signed in (password, Google or GitHub, with or without two-factor authentication);
  • when and where you first signed in, and when it was last active;
  • its last IP address and approximate location (city and country). Addresses on a private network show as Local network; when the location is unknown it shows —;
  • how long it stays signed in: “Remembered on this device until” a date if you chose Remember me, otherwise “Signs out when the browser closes”.
Choose Sign out to sign one device out, or Sign out all other sessions to sign out everywhere except here. A signed-out device stops working right away and shows why on its next action, for example “You were signed out from another device”.

​
Security activity

Security activity is your account’s security log: sign-ins and failed attempts, sign-outs, password, email and two-factor changes, recovery codes, linked accounts, exports and deletion requests. Each entry shows what happened, whether it succeeded, the device, IP address, approximate location, and the time in your time zone. Filter by Event type and Date range (the last 7, 30, 90 or 365 days), page through older entries, and choose Export CSV to download them. Entries are kept for 365 days.

​
Security alerts

Weelkit sends you an email and an in-app notification, under Alerts in your notifications, when:
  • someone signs in to your account from a new device or location;
  • your password is changed, or a password reset is completed;
  • two-factor authentication is turned on or off, or recovery codes are generated or used;
  • your email address is changed (the alert goes to your old address, with a link to undo it);
  • a Google or GitHub account is linked or unlinked;
  • your account is locked after too many failed sign-ins;
  • your account deletion is scheduled or cancelled.
Each email says what happened, when, on which device, from which IP address and approximate location, with a Wasn’t you? link to this page. The in-app notification links to your security activity. Security alerts can’t be turned off.
If an alert wasn’t you: change your password, choose Sign out all other sessions, and check that two-factor authentication is on.

​
Confirm your identity

Before sensitive changes, Weelkit asks you to sign in again in a dialog, without leaving the page: your password and, if you use it, your authenticator code. Accounts without a password confirm with Google or GitHub instead. The confirmation lasts 10 minutes. You’re asked to confirm before you:
  • turn two-factor authentication on or off, or generate recovery codes;
  • change your email address;
  • link or unlink a Google or GitHub account;
  • export your data or your organization’s data;
  • delete your account, or cancel its deletion;
  • delete an organization, transfer its ownership, or change its security settings.

​
Failed sign-ins

After several wrong passwords, Weelkit pauses new password attempts for that account for 15 minutes, and sends you an alert. Devices that are already signed in keep working, and Google or GitHub sign-in still works. Each two-factor sign-in allows at most 5 codes. Resetting your password ends the pause.