Password

Your username or your verified email address, plus a password. If you have a second factor, it is asked for after.

Passkey

A key stored by your device and unlocked with your face, fingerprint or screen lock. There is nothing to remember and nothing to type, and there is no password for a phishing site to collect, which is the real reason to prefer it.

A passkey is registered under Security. Register a second one on another device, or keep your password as the fallback, so a lost phone is an inconvenience rather than a lockout.

Recovery key

A long key generated once when you signed up. It signs you in when the password and the second factor are both unavailable. See The recovery key.

Sign in from a device we have not seen

A sign in from a device we do not recognise sends a notice to your verified address. If a notice arrives for something you did not do, change your password and check your active sessions and app passwords immediately.

What we do not ask for

We never ask for your password by email, we never ask for a code by email or chat, and we never ask for your recovery key at all. Anybody who does is not us.