Two-factor, passkeys, and signing out everywhere

Over the summer we moved the platform onto a new database and rebuilt the way signing in works. None of that was visible from the outside, and it was the part that had to come first. The old system had nowhere to safely keep a second factor, a passkey, or a record of the sessions you are signed in on. Now that it does, all three are here, on a new Security page in your settings.

Two-factor authentication. Turn it on and signing in asks for a six-digit code from your authenticator app after your password, so knowing your password is no longer enough on its own. Setting it up shows a QR code to scan, so you can point 1Password, Google Authenticator or your phone's own app straight at it, and it gives you a set of backup codes you can download as a file for the day you do not have your phone with you.

Passkeys. A passkey signs you in with whatever already unlocks your device: a fingerprint, your face, or your password manager. There is no code to type and no password to remember. And because a passkey is tied to designed.org itself, it cannot be handed over to a site pretending to be us, which is what makes it the strongest of the three. Add one from the Security page, and your password manager will offer it the next time you open the sign-in page.

Where you are signed in. The page lists every live session on your account with the device, when it started and roughly where from, so you can recognise your own and notice one you do not. One button signs you out everywhere except the browser you are using. Sessions that began before this change have no location recorded, and say so rather than guessing at one.

You can also change your password there, which until now meant sending yourself a reset email.

None of this is required, and nobody is being moved onto it. If you change nothing, your account works exactly as it did yesterday. But if you mentor here, if your profile is how people find you, or if you would simply rather your account were harder to take, these are the three things worth doing. Between them they take about two minutes.