Your account and security

Manage your own account from Your account in the sidebar (on a phone, More → Your account).

Profile

Your name appears to teammates and in the change history. Your email address is your sign-in. To change it, click Change email and confirm with your password; we send a link to the new address (valid for 24 hours) and let the old one know. Confirming signs you out everywhere.

Spelling

Proto Tracker uses British or American spelling (organisation or organization, colour or color) to match your browser’s language. To choose one yourself, open Your account → Preferences → Spelling. The choice applies on that device, and to the emails we send you from it.

Password

Change your password with your current one under Password. Changing it signs you out on every device, including this one.

Passwords need at least 8 characters. Common passwords, and any that have appeared in a known data breach, aren’t accepted, because attackers try those first. A short phrase is easy to remember and hard to guess.

Forgotten it? Use Forgotten your password? on the sign-in page. The reset link lasts 30 minutes and works once.

Two-factor authentication

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app (such as 1Password, Google Authenticator, Microsoft Authenticator, or Authy) as well as your password when you sign in. We strongly recommend it for owners and admins.

To turn it on:

1. Under Two-factor authentication, click Set up two-factor authentication and confirm your password.
2. Scan the QR code with your authenticator app, or type in the key shown.
3. Enter the 6-digit code the app shows and click Turn on.
4. Save your recovery codes. You get ten, and each works once. If you lose your phone, a recovery code is the only way to sign in. Keep them in a password manager or print them.

When signing in, enter the code from your app, or click Lost your device? Use a recovery code. Resetting your password doesn’t bypass two-factor authentication.

Running low on recovery codes? Click New recovery codes (the old ones stop working). To turn 2FA off, click Turn off and enter your password and a code. We email you whenever 2FA is turned on or off.

Sign out everywhere

Lost a laptop or used a shared computer? Sign out everywhere ends every session on every device immediately.

Your data

• Admins can download everything their organisation holds as JSON, and its change history as CSV. See Change history and export.
• Deleting your account shows what will happen to each of your organisations before anything is deleted. Organisations where you’re the only member are deleted with it, including their data and subscription. Where you’re the only owner, you choose a member to take over. You simply leave the rest.

How your account is protected

Passwords are stored using Argon2id hashing, never in plain text, and passwords found in known data breaches are refused. Two-factor authentication is available to everyone, on every plan. Sessions expire quickly and are renewed securely in the background. Sign-in attempts are rate limited, and all data is encrypted in transit and at rest. Read the full security overview.