Your profile and sign-in

Your account settings are about you rather than about any website or organization. Reach them from your avatar in the top navigation.

Profile

Your name, email address, and photo. The name and photo are what teammates see in an organization's members list.

Signing in

Enter your email on the login page and choose Continue. What comes next depends on your account:

• You added a passkey. Your device asks for it straight away. If you also have a password, Use your password switches to it.
• You have a password. Enter it. Forgot your password? sends a reset link.
• Neither. We email you a 6-digit code at once. Type it in, and the box sends it as soon as the sixth digit is in.

Email me a code stays available under a passkey or a password, so you can always sign in from your inbox. Use a different email takes you back to the first step, and so does leaving the page for ten minutes, so the next person at a shared computer never sees your email. A browser that cannot use passkeys opens on your password instead.

A code works once and expires after 10 minutes. Only the newest code works, and only in the browser that asked for it, so use the latest email if you asked for more than one. You can ask for a new code a minute after the last. Five wrong tries stop a code from working: wait for it to expire, up to 10 minutes, then ask again. After several tries for one address, a quick person check may appear: pass it and the form sends again by itself.

A password or a passkey is optional, and you add either under your account settings. If you turned on two-factor authentication, you still enter its code after an emailed code or a password.

Changing your email address

Your email address is how you sign in, and where your sign-in codes and password resets go. Moving it is treated like a change of key rather than a change of text.

Three things happen when you ask for a new address:

1. You confirm it's you. With a password, you enter your current one. Without one, Confirm it's you opens a page where you can use a passkey or choose Email me a code. Nothing is sent until you choose the code, and it goes to your current address. Being signed in is not enough on its own.
2. The new address gets a confirmation link. It expires in an hour.
3. Your current address gets a warning, telling you a change was requested and giving you a one-click link to cancel it.

Until the new address opens its link, nothing about your account has moved. You still sign in with your old address. Codes and password resets still go there. The settings page shows the pending change with a Cancel this change button.

This is deliberate. If someone else ever reaches your account — a shared computer, a borrowed session — they cannot quietly swap your email for theirs and lock you out. You would get the warning email at the address you still control, and one click stops it.

If a warning email arrives that you did not ask for: cancel the change from that email, then change your password straight away if you have one. Somebody has your session or your password.

Password

A password is optional. If you signed up with a code, your account has none, and Settings → Security offers Add a password.

Changing an existing password asks for the current one as well as the new one. A password needs at least 8 characters with upper and lower case, a number, and a symbol. It is checked against a list of passwords known to have leaked elsewhere. A rejected password is not a judgment about you: it is one that has already appeared in someone else's breach.

Opening the security page asks you to confirm it's you first, so a machine left unlocked cannot be used to change how you sign in. You confirm with your password. With no password, you confirm with a passkey or an emailed code. That same confirmation lets you add your first password.

Two-factor authentication

Two-factor authentication asks for a rotating six-digit code from an authenticator app after your emailed code or password. Set it up by scanning the QR code with an authenticator app — 1Password, Authy, Google Authenticator, or whatever you already use.

When you enable it you are given recovery codes. Save them somewhere that is not the device holding the authenticator app. They are how you get back in if you lose the phone, and each one works once.

Passkeys

A passkey signs you in with the same thing that unlocks your device — Face ID, a fingerprint, a Windows Hello PIN, a hardware key. There is no code to type and nothing to phish.

Add as many as you have devices; each is listed with the date it was added so you can remove one you no longer have. A passkey does not take away your other ways in. The emailed code, and your password if you have one, stay as fallbacks, but day to day you will stop using them.

Staying signed in

You stay signed in for 30 days without doing anything to keep it that way, and every visit starts the 30 days over. Building a website is rarely one sitting — you write some copy, close the tab, and come back after the weekend — and coming back should not mean signing in again.

Two things end it sooner: signing out, and clearing your browser's cookies. Closing the browser does not. If you are on a machine that is not yours, sign out when you are done — that is what the control is for, and it is the only thing that reliably ends the session on that computer.

Signing in with an emailed code remembers you on that device without asking. On the password form, Remember me is still worth ticking on your own devices; it keeps you signed in past the 30 days.

Some things ask you to confirm it's you again even while you are signed in: opening the security page, changing your password, adding a passkey. You confirm with your password, a passkey, or an emailed code if you have no password. That check is separate and deliberately short-lived, so a machine left unlocked cannot be used to change how you sign in.

Appearance

Light, dark, or follow your system. The setting is remembered per browser, and the builder has its own quick toggle in its menu for when you are working late.

Deleting your account

Settings has no delete-account control today, so you cannot delete your account yourself. You can still remove what it holds: transfer your websites or delete them.

Next

• Your team — how your account relates to the people you work with.
• Organizations — where your websites actually live.