Security

Under Settings → Security you manage how you sign in, and can delete your account.

Password

Change the password you sign in with. It needs at least 8 characters. Changing it signs you out on your other devices.

If you forget it, use Forgot password on the sign-in page. Reset links work once, for an hour.

Two-factor authentication

With two-factor on, signing in needs your password and a 6-digit code from an authenticator app such as Authy, Google Authenticator or 1Password.

1. Choose Set up two-factor authentication, then scan the QR code with your authenticator app (or enter the key it shows).
2. Enter the 6-digit code the app shows and choose Turn on.
3. Save your recovery codes.

Turning two-factor off needs your password and a code from your app (or a recovery code).

Recovery codes

You get 10 recovery codes when you turn two-factor on. If you lose your phone, each code signs you in once. They're only shown once, so keep them in a password manager or somewhere safe.

The Security page shows how many codes are left. Making new ones replaces the old codes, which stop working.

Deleting your account

Deleting your account is permanent and can't be undone. You confirm it with your password.

Security alerts

Graph always emails you when your password is changed or reset, two-factor is turned on or off, or new recovery codes are made. These emails can't be turned off.