Account security

Open the security page

Open Settings from the user menu and select Security under Account. These controls protect your account across all workspaces; workspace access policies are configured on each workspace's Security page.

Password, linked login, and passkeys

• Password: choose Change password and complete the verification requested by the dialog.
• Linked login: connect or disconnect the provider shown on the page. Quill prevents a change that would leave the account without a valid login path.
• Passkeys: add a named passkey, review its device type and last use, or remove credentials you no longer control.

A passkey may be device-bound or synchronized by its platform. The label and status shown by Quill help you distinguish credentials, but availability on another device depends on the authenticator that created it.

Trusted devices and two-factor authentication

A trusted device can sign in and unlock the same account in the browser where it was enrolled. You can enroll the current browser, rename an entry, revoke one device, or revoke all other devices. If this browser cannot find its saved trusted credential, retry before changing trust; revoking an entry does not restore a missing browser credential.

Two-factor authentication adds a verification code after primary sign-in. When enabling it, finish setup and save the recovery information shown. When rotating recovery codes or disabling two-factor authentication, complete the confirmation requested on screen.

Passkey

A login credential created with a device or security key. The list shows its label, platform or security-key type, synchronization status, creation time, and last use.

Trusted device

An enrolled browser that can restore account access. Current, last-used, created, and expiry labels help identify entries before revocation.

Two-factor authentication

Requires an authenticator code after the primary login. Recovery codes are the fallback when the authenticator is unavailable.

Trust the current browser

1. Choose Enroll this browser under Trusted devices.
2. Complete the identity proof shown and give the browser a recognizable name.
3. Return to the list and confirm that the entry is marked Current and shows an expiry time.

After completion: This browser appears in Trusted devices and can be used for supported account-unlock flows until it expires or is revoked.

Review active sessions

The sessions list identifies the current session, sign-in method, device summary, approximate network location, review status, and last activity. Use these signals together; a location can be approximate or changed by a network service.

1. Confirm sessions you recognize and reject suspicious review requests.
2. Revoke an individual session you no longer use, or revoke other sessions when broader cleanup is needed.
3. If you suspect account compromise, also change the affected sign-in credential and review trusted devices.

Review and revoke a session

1. Compare the device summary, sign-in method, approximate location, and Last seen time.
2. Choose Confirm for a pending session you recognize, or Reject for one you do not.
3. Revoke an unfamiliar session. If it is the current session, Quill signs this browser out.

After completion: Revoked sessions disappear from the active list after refresh and can no longer use that sign-in session. Other credentials remain until changed separately.

States and recovery

Loading and empty states mean Quill is still checking or no credential of that type is registered. An error means the current list or action was not confirmed; refresh before assuming a security change succeeded.