Your profile and sign-in

Your account settings are about you rather than about any website or organization. Reach them from your avatar in the top navigation.

Profile

Your name, email address, and photo. The name and photo are what teammates see in an organization's members list.

Changing your email address

Your email address is how you sign in and where a password reset would go, so moving it is treated like a change of key rather than a change of text.

Three things happen when you ask for a new address:

1. You are asked for your current password. Being signed in is not enough on its own.
2. The new address gets a confirmation link. It expires in an hour.
3. Your current address gets a warning, telling you a change was requested and giving you a one-click link to cancel it.

Until the new address opens its link, nothing about your account has moved. You still sign in with your old address, a password reset still goes there, and the settings page shows the pending change with a Cancel this change button.

This is deliberate. If someone else ever reaches your account — a shared computer, a borrowed session — they cannot quietly swap your email for theirs and lock you out. You would get the warning email at the address you still control, and one click stops it.

If a warning email arrives that you did not ask for: cancel the change from that email, then change your password straight away. Somebody has your session or your password.

Password

Changing your password asks for the current one as well as the new one. A password needs at least 8 characters with upper and lower case, a number, and a symbol, and it is checked against a list of passwords known to have leaked elsewhere — a rejected password is not a judgment about you, it is one that has already appeared in someone else's breach.

Opening the security page at all asks you to confirm your password first, so a machine left unlocked cannot be used to change how you sign in.

Two-factor authentication

Two-factor authentication asks for a rotating six-digit code in addition to your password. Set it up by scanning the QR code with an authenticator app — 1Password, Authy, Google Authenticator, or whatever you already use.

When you enable it you are given recovery codes. Save them somewhere that is not the device holding the authenticator app. They are how you get back in if you lose the phone, and each one works once.

Passkeys

A passkey signs you in with the same thing that unlocks your device — Face ID, a fingerprint, a Windows Hello PIN, a hardware key. There is no code to type and nothing to phish.

Add as many as you have devices; each is listed with the date it was added so you can remove one you no longer have. A passkey does not replace your password — the password stays as a fallback — but day to day you will stop using it.

Staying signed in

You stay signed in for 30 days without doing anything to keep it that way, and every visit starts the 30 days over. Building a website is rarely one sitting — you write some copy, close the tab, and come back after the weekend — and coming back should not mean signing in again.

Two things end it sooner: signing out, and clearing your browser's cookies. Closing the browser does not. If you are on a machine that is not yours, sign out when you are done — that is what the control is for, and it is the only thing that reliably ends the session on that computer.

Remember me on the sign-in screen is still worth ticking on your own devices; it keeps you signed in past the 30 days.

Some things ask for your password again even while you are signed in — opening the security page, changing your password, adding a passkey. That check is separate and deliberately short-lived, so a machine left unlocked cannot be used to change how you sign in.

Appearance

Light, dark, or follow your system. The setting is remembered per browser, and the builder has its own quick toggle in its menu for when you are working late.

Deleting your account

Deleting your account is permanent and removes everything belonging to it. If you own an organization with websites in it, deal with those first — either transfer them or delete them — so nothing is left without an owner.

Next

• Your team — how your account relates to the people you work with.
• Organizations — where your websites actually live.