Account security
Passwords, two-factor authentication, signed-in devices, changing your email, and what to do if something looks wrong.
Everything in this page is under your account settings, on the web and in the app. On the web, email and password are under Settings → Account, and two-factor authentication and sessions are on the Sessions & two-factor page (Sessions & 2FA in the settings menu); in the app, they are in the account screens.
Your password
A password is at least 10 characters. On the web, the sign-up and reset forms show a strength indicator as you type; it is advice, and the length is the rule.
To change it, enter your current password and the new one twice. Changing your password signs you out on every other device — that is deliberate, and it is the fastest way to end a session you do not recognise.
Novagora checks new passwords against known breached credentials and refuses one that appears in them.
If you have forgotten it, use Forgot password? on the sign-in screen. The answer is the same whether or not the address has an account, so the screen never reveals who is registered. A reset link works for one hour; if yours has expired, request a new one.
Two-factor authentication
Two-factor authentication adds a second step at sign-in, from an authenticator app.
- Open Two-factor authentication and confirm your password.
- Scan the QR code with your authenticator app. If you cannot scan, copy the setup key (on the web) or the setup URI (in the app) instead.
- Enter the 6-digit code to confirm.
- Save your backup codes. You get ten, each usable once, and they are what gets you in if you lose the authenticator.
At sign-in you then enter a code. Use a backup code instead (in the app, Use a backup code) switches to entering one of your backup codes, and Trust this device for 30 days stops it asking on that device for a while.
Turning it off also needs your password. Confirming your password is required for the sensitive changes generally — enabling and disabling two-factor, generating new backup codes, changing your email, and scheduling deletion.
Keep the backup codes somewhere that is not the phone with the authenticator on it. Novagora cannot restore access for you.
Devices and sessions
Sessions lists where you are signed in, with the device, the address it was seen from, and when. Your current session is marked This device.
- Sign out ends one session immediately.
- Sign out all other sessions (in the app, Sign out of all other sessions) ends every session but this one.
- Sign out everywhere ends every session, this one included, and you sign in again.
Each of these is confirmed first, and in the app the confirmation says how many devices are affected. A signed-out session cannot be resumed — that device signs in again from scratch.
Your email address
Changing your email needs your current password. Novagora then sends a confirmation link to the new address; the change takes effect when you open it. Until then, the old address is still your account's.
The link works for one hour. If you never receive it, check the spam folder of the new address and start again.
Signing in
You can sign in with your email or your username, plus your password. Ten failed attempts in a row lock the account for 15 minutes; the lock lifts on its own, and waiting is the fix.
Sign-in, sign-up, and password reset run a verification check. Usually it passes without you noticing; when something looks automated, it asks you to complete a challenge. It is there to keep automated attempts off your account.
If something looks wrong
Novagora emails you when something sensitive happens on your account: a completed sign-in, a password change, an email change (to both the old and the new address), and two-factor authentication being turned on or off. If one of those was not you, start here:
- Change your password. That signs out every other device.
- Turn on two-factor authentication if it is not already on.
- Review your sessions and revoke anything left that you do not recognise.
- Check your email address under account settings — an attacker's first move is to change it.
- If you cannot get in at all, use the password reset, then contact support through the Contact page.
Novagora will never ask you for your password, a two-factor code, or a backup code by email or in a message.