Confirm it's you before adding a passkey or a password
A passkey or a new password is a new way into your account, so adding one now asks you to confirm it's you first, and we email you whenever one is added.
Passkeys3 changes
- Changed
Adding a passkey asks you to confirm it's you
When you select Add a passkey under Account & security, a Confirm it's you box asks for the code from your authenticator app (or a backup code) if you have two-factor on, otherwise your password. If you sign in by email link or with Google, Microsoft or Apple, it asks you to sign in again, then brings you back to finish. Once confirmed, you can add passkeys for ten minutes without being asked again.
- New
An email whenever a passkey is added
We now email you each time a passkey is added to your account, saying when, and its name if you gave it one. If it wasn't you, remove it under Account & security and change your password.
- Improved
Signed in a while ago? Sign in again, not an error
If you last signed in more than a day ago, adding a passkey now offers Sign in again and brings you back to finish, instead of showing an error.
Passwords2 changes
- Changed
Setting your first password asks you to confirm it's you
If you sign in by email link or with Google, Microsoft or Apple, Set password under Account & security now asks you to sign in again first unless you signed in within the last ten minutes, then brings you back to finish. With two-factor on, it asks for your code instead.
- New
An email when a password is added
We now email you when a password is added to an account that didn't have one. If it wasn't you, use Forgot password? on the sign-in page to reset it — that signs every device out.