Account Security

Protect the dashboard account with a strong password, an authenticator app, and passkeys, all from the Security page.

Why Add Sign-In Security?

1. Adds an authenticator app so a stolen password alone can't sign in.
2. Gives you recovery codes so losing your phone doesn't lock you out.
3. Adds passkeys so you can sign in without typing a password.
4. Asks for your password before every change so a browser left signed in can't quietly change how you sign in.

Open the Security Page

Select Security in the sidebar, or Password and sign-in in the account menu. The page has four parts: Password, Username, Authenticator app, and Passkeys.

Change the Password

1. Under Password, enter your Current password.
2. Enter a New password of at least 12 characters, and repeat it under Confirm new password. The bar under the field rates it from Weak to Strong, and any password of 12 or more characters is accepted.
3. Select Change password.

Changing the password signs out every other browser, and this one stays signed in.

Change the Username

1. Under Username, enter a New username: 3 to 64 letters, numbers, periods, underscores, or hyphens, starting with a letter or number.
2. Enter Your password and select Change username.

The new username applies right away, including in browsers that are already signed in.

Turn On an Authenticator App

1. Under Authenticator app, select Set up. A dialog walks through three steps.
2. Enter your password and select Continue.
3. Scan the QR code with an app such as 1Password, Google Authenticator, or Authy, or type the Setup key into the app. Copy puts the key on the clipboard.
4. Enter the 6-digit code from the app under Code, and select Turn on.
5. Save the ten recovery codes with Copy all or Download .txt, check I saved these codes, and select Done.

• You have 10 minutes to finish these steps before you need to start again.
• From then on, password sign-in asks for a code, and each code works only once.
• If Outpost turned the app off after losing its encryption key, the Set up the authenticator app link in the Saved secrets were removed notice opens the Security page. Turning the app on again takes it off the notice, as described in Web Dashboard.

Recovery Codes

• Each recovery code works once in place of an authenticator code. Authenticator app shows how many are left.
• The codes appear only once. Outpost stores only a hash of each one, so it can't show them again.
• New recovery codes asks for your password, then shows the new set in the same dialog and replaces the old one, so the old codes stop working.
• Done stays unavailable until I saved these codes is checked, and the dialog can't be closed another way, because the codes aren't shown again.

Add a Passkey

1. Under Passkeys, enter a Passkey name of up to 80 characters, such as the device it's on.
2. Enter Your password and select Add passkey.
3. Follow your browser's prompt.

• Passkeys need the dashboard open at a domain name over HTTPS, or at localhost. On an IP address or plain HTTP, the page explains why it can't add one there.
• A passkey works only at the address it was added on, and the list shows that address next to each one. Opening the dashboard at a new address means adding your passkeys again there.
• Behind a reverse proxy, HTTPS and the address come from its headers, as described in Web Dashboard.

Remove a Method

• Authenticator app — Select Turn off, enter your password in the dialog, and select Turn off again. The recovery codes are deleted with it.
• Passkey — Select Remove next to it, enter your password in the dialog, and select Remove passkey. It stops working right away.

If You Lose Access

• Lost phone — Sign in with a recovery code or a passkey. Then turn the authenticator app off and set it up again on your new phone.
• Forgotten password — There's no password reset, but a passkey still signs you in. Backup and Recovery covers the other ways back in.