Secure your account: two-step verification and signed-in devices

Turn on two-step verification#Link to “Turn on two-step verification”

1. 1In Settings, find “Two-step verification” and choose “Turn on two-step verification”.
2. 2Confirm your password, then scan the QR code with an authenticator app, or type the key in by hand.
3. 3“Save your backup codes” before continuing. Each code works once. You can reopen the list in Settings with your password; used codes are crossed out, and “Reset backup codes” replaces the set.
4. 4Enter the code your app shows and choose “Confirm and turn on”.

Turning it on asks for your password. If you signed up with Google or a sign-in link and have no password yet, use “Add a password” first. If you cannot use your authenticator, choose “Sign in another way” on the verification page, then “Use a backup code”.

Choose another way to verify#Link to “Choose another way to verify”

Choose “Sign in another way” to see the methods available for your current sign-in. Depending on your setup, these may include an authenticator app, email, text message, or a saved backup code. Email codes require signing in with your password first. Email and text delivery must also be available for your account.

After choosing email or text, select the send-code button. The page confirms when the code has been sent and then asks you to enter it. Wait for the resend countdown if you need another code. If your sign-in has expired, return to sign in and start again.

Backup codes#Link to “Backup codes”

1. 1Under Two-step verification, “Backup codes” says how many are left.
2. 2Choose “Show codes” and enter your password. A code you have already used is crossed out and will not work again.
3. 3Copy the unused codes, download them, or print them. Hiding the list does not delete it.
4. 4“Reset backup codes” asks for your password, retires every current code whether or not you have used it, and shows a new set of 10.

Codes used before this list existed are counted, but the code itself can’t be shown. Resetting is how you get a list that records each one.

See and sign out devices#Link to “See and sign out devices”

• “Signed-in devices” lists each browser with its IP address, when it was last active, and when it signed in. The one you are using is marked “This device”.
• Sign any one of them out, or choose “Sign out all other devices”.
• Changing your password under “Change password” also signs out every other device.
• You stay signed in while you use PaloWorks; a session left unused for 7 days expires.

Passkeys#Link to “Passkeys”

Under “Passkeys”, choose “Add a passkey” to sign in with Face ID, Touch ID, Windows Hello, or a security key instead of a password. A passkey only works on this site, so a look-alike phishing page cannot use it.

Require it for your whole team#Link to “Require it for your whole team”

An owner can require it for everyone: under “Require two-step verification” in Settings → Sign-in security, choose “Require for everyone”. You have to turn it on for your own account first. From then on, anyone in the workspace without it — owners included — is taken to a page to set it up before they can open anything else.

Security email#Link to “Security email”

You get an email when your password is changed or reset, and when your account is signed in from a new kind of device while another device is already signed in. These always send, whatever your notification settings say.

Other ways to sign in#Link to “Other ways to sign in”

• “Email me a sign-in link” on the login page sends a link that works once and expires after 10 minutes.
• A password reset link expires after an hour, and using it signs out every session.
• To change the email address on your account, write to support@paloworks.com.

Found a security problem in PaloWorks itself? How to report it is in the Privacy Policy.