Login security
Every login takes two steps: a passkey, or a password and a code from your app or by email. See and end your logins, and read their history.
Updated 22 Oct 20265 min read
Every login to Tanzahost takes two steps, so a stolen password alone never opens your account. The easiest is a passkey: your fingerprint, your face or your screen lock, which counts as both steps. With a password, the second step is a code: from your authenticator app if you added one, otherwise a 6-digit code we email you. Your Security page shows where you're logged in and every login to your account.
The two steps
| You log in with | The second step |
|---|---|
| A passkey | None needed: the passkey is both |
| A password, with an authenticator app added | The app's 6-digit code, or a recovery code |
| A password, without an app | A 6-digit code we email you, valid for 15 minutes |
| Google or GitHub | The same as a password: the app's code, or a code by email |
Right after you sign up, the code that proved your email counts as your second step, so you aren't asked twice. From your next login on, you are. Once you add an authenticator app, it replaces the emailed code: someone who reaches your email still can't log in.
Ways to log in
| Way | How it works |
|---|---|
| Passkey | Your device's fingerprint, face or screen lock. It can live on this device, your phone, a password manager or a security key |
| Password | At least 15 characters. A short sentence works well, like "my shop opens at eight" |
| Authenticator app | After your password, a 6-digit code from an app like Google Authenticator or 1Password |
| Code by email | After your password, if you have no app: a 6-digit code sent to your email |
| Recovery codes | If you lose your phone, each code logs you in once instead of the app |
| Google or GitHub | Where the login page offers them, log in with an account you already have |
A password that appeared in a known data leak on another website is refused. Text messages are never used as a second step, because phone numbers can be stolen.
Add a passkey
Open your profile menu in the top bar, then Security.
Choose Manage how you log in. For your safety, you may be asked to log in again.
Under Passkeys, choose Add a passkey, and follow your device.
Add one on each device you use, or keep one in a password manager that syncs. Changing a password, a passkey or the second step needs a login from the last 15 minutes.
Turn on the authenticator app
In Manage how you log in, under Authenticator app, scan the code with your app, or type in the key.
Type the 6-digit code it shows, and choose Turn on.
Choose Make recovery codes, and save them somewhere safe, like a password manager or printed at home. Each works once.
From then on, after your password, the login asks for the app's code. Lost your phone? Choose Use a recovery code instead. Step by step: turn on two-step login.
Example: Asha secures her shop
Asha first signed up with a password. Her shop takes real money now, so she opens Security, adds a passkey on her phone and another on her laptop, and from then on logs in with her fingerprint. She keeps her password too, with the authenticator app as its second step and her recovery codes in her password manager, for the day she has to log in from a borrowed laptop.
Where you're logged in
Security lists each browser and device with an open login: what it is, when it logged in and when it was last used. Log out ends one; Log out everywhere ends every login to your account, on every device, this one included. You stay logged in for 30 days on each device unless you log out.
The first time someone logs in to your account from a device we haven't seen, we email you. That alert is always on.
Login history
Login history lists logins, tries that failed, and every change to how you log in: a new passkey, a new password, the app turned on or off. Each line shows the device and roughly where it was. Something you don't recognise? Choose Log out everywhere, then change your password or add a passkey.
How we protect logins
Too many failed logins pause password login for a while.
Logins are slowed per account and address together, so people sharing one mobile network's address aren't locked out together.
The login page answers the same whether an email has an account or not, so nobody can find out who has one.
A Google or GitHub login joins an existing account only after you log in the usual way first, so a look-alike email can't take it over.
Forgot your password?
On the login page, choose Forgot your password? and type your email. If it has an account, a 6-digit code arrives, valid for 15 minutes. It lets you set a new password or add a passkey; to open the rest of your account, finish with your second step as usual.
Steps that need a fresh login
Some actions ask you to log in again if your last login is more than 15 minutes old, even when you're logged in: changing how you log in, and closing the account. A registered domain asks for more: unlocking it, changing its nameservers or its owner's details, or showing its transfer code need your passkey or your second step from the last 15 minutes. That way a stolen session, or a stolen password alone, can't do them.