# Secure your account: password, 2FA and sessions

> Your account's security settings, and the four delays worth knowing before you need them, including the one that reopens an account you have lost everything for.
> https://facteur.eu/en/help/compte-et-securite

Everything is in [**Settings → Profile**](https://app.facteur.eu/settings/profile) and
[**Settings → Security**](https://app.facteur.eu/settings/security).

## The four delays worth knowing in advance

| What you do | The delay |
|---|---|
| Revoke a session | Up to **5 minutes** before it stops answering |
| Open a password reset link | **Immediate**: all your other sessions are cut |
| Lift two-factor authentication without your phone | **72 hours** |

## Change your password

**Twelve characters minimum**, from
[**Settings → Profile**](https://app.facteur.eu/settings/profile). No required capital,
no imposed special character: those rules produce short, predictable passwords, where
length does the work.

## Reset a forgotten password

Ask for a link from the [sign-in screen](https://app.facteur.eu/login). The form answers
the same thing whether the address exists or not, so that it cannot be used to find out
who is a customer.

The link you get is **single-use** and lasts an hour.

> **Opening that link cuts all your other sessions**, immediately. That is what you want
> when you suspect an intrusion: changing the password also throws out whoever was in.

Three sends per hour per recipient address, plus a limit per IP address.

## Turn on two-factor authentication

Open [**Settings → Security**](https://app.facteur.eu/settings/security) and scan the QR
code with the authenticator app of your choice. The code is then asked for at every
sign-in. Keep the backup codes the screen shows you.

**Your organization can require it.** Until you turn it on, you stay signed in and keep
reading everything, but creating, changing or deleting anything is refused, with a
message that sends you here. Access comes back as soon as you enable it, with no need to
sign in again.

Two points:

- **The requirement belongs to the organization**, not to your account. If you belong to
  several organizations, it only applies in the one that set it.
- **A passkey does not satisfy it.** It signs you in on its own, but the rule is about
  the one-time code today.

## You lost your phone and your backup codes

There is a way out, and it takes **72 hours**.

1. On the screen asking for your code, choose **"lift after a security delay"**.
2. Enter your password. That is what proves it is you.
3. Come back three days later and sign in: you can then lift two-factor
   authentication.

During those three days:

- you get a message containing **a link to cancel the request in one click**;
- the people responsible for your organizations are notified, **without that link**.
  They are informed, they do not decide for you;
- a banner appears in each of your sessions that is still open, with the same cancel
  button. If you are still signed in somewhere, you do not even need the email.

At the deadline, the lift destroys your authenticator app, your backup codes and your
trusted devices, and closes all your sessions. Sign back in with your password alone,
then set up two-factor authentication again.

> **We cannot shorten that delay, and nobody here will offer to.** No button exists, for
> anybody, that speeds a request up. That is what makes a convincing phone call not
> enough to get into your account. Without the delay, somebody who stole your password
> would remove your two-factor authentication in a minute.

**If you still have a passkey, this path is refused to you.** You do not need it: go
back to [sign-in](https://app.facteur.eu/login) and choose **Sign in with a passkey**.

Three requests per day at most. Cancelling and asking again does not bring the deadline
closer.

## Revoke a session

[**Settings → Security**](https://app.facteur.eu/settings/security) lists your active
sessions and lets you revoke them. A session lasts seven days.

Allow **up to five minutes** before a revoked session stops answering: the cookie
carries a signed copy of its state, and deleting a row in the database does not reach a
cookie already sitting in a browser.

If five minutes are five minutes too many, change your password: opening the reset link
cuts everything, immediately.

## Confirm your email address

A link valid for 24 hours is sent at sign-up. You come in without waiting for it and you
name your organization, but until it is opened you cannot create an inbox, invite
anyone, or mint an API key, see [First message](premiers-pas).

Click **Send the link again** in the banner at the top of the application if the
24 hours have passed.

Click **That is not the right address**, in the same banner, to correct a typo: the new
link goes out immediately. The address also stays editable in
[**Settings → Profile**](https://app.facteur.eu/settings/profile) for as long as it is
unconfirmed.

An account whose address is never confirmed is deleted after 7 days, along with the
organization it created. A reminder goes out the day before. After the deletion, you can
sign up again with the same address.

## Sign in with Google or your company's SSO

The Google button only appears if the instance really has Google credentials. SSO
sign-in happens by address domain and assumes a configured, verified provider, see
[SSO](sso).

## Delete your account

[**Settings → Profile**](https://app.facteur.eu/settings/profile), danger zone. Type
`DELETE`, then confirm through the link sent to your address.

Your inboxes, your messages and your API keys are deleted, backups included. This does
not delete your organization, see [Your organization](organisation).