> ## Documentation Index
> Fetch the complete documentation index at: https://docs.caard.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Password, two-factor authentication, and active sessions.

Manage account security at **Settings → Security**.

<Note>
  For sensitive changes — updating your password or changing two-factor settings — Caard may ask you to re-confirm your identity first.
</Note>

## Password

Change your password, or set one if you signed up without one. Changing it requires your current password; setting one for the first time doesn't.

By default, **Sign out of all other sessions** is checked when you save a new password — every device except your current one is signed out. Untick it to keep other sessions alive.

## Two-factor authentication

Two-factor authentication (2FA) adds a second step at sign-in: a six-digit code from an authenticator app.

<Steps>
  <Step title="Enable 2FA">
    Select **Enable** under Two-factor authentication.
  </Step>

  <Step title="Scan the QR code">
    Scan it with an authenticator app such as Google Authenticator, 1Password, or Authy. Can't scan? Copy the setup key shown next to the QR code and enter it in your app manually.
  </Step>

  <Step title="Confirm with a code">
    Enter the six-digit code from the app — it verifies automatically once you type the last digit.
  </Step>

  <Step title="Save your backup codes">
    Copy the backup codes and store them somewhere safe. Each code works once if you lose access to your authenticator.
  </Step>
</Steps>

Once 2FA is on, the same section lets you:

* **Regenerate backup codes** — issues a fresh set and invalidates all previous ones.
* **Disable 2FA** — turns off the second sign-in step.

<Warning>
  Without your authenticator app or a backup code, you can be locked out of your account. Store backup codes securely — not on the same device as your authenticator.
</Warning>

## Sessions

The **Sessions** list shows everywhere you're signed in — device, approximate location, and when it was last active. Your current device is marked **Current**.

* **Sign out** an individual session you don't recognise.
* **Sign out of all other sessions** to keep only your current device signed in — do this if you suspect your account is compromised, then change your password.