People, access, and being told
Signing in and two-step sign-in
Your password and one more proof it is you: codes by email, text or an app, recovery codes, a forgotten password, and the way back in when you are locked out.
You sign in with your email address and your password. Tick Remember me and the browser keeps you signed in on that device. Too many wrong tries in a minute and the page asks you to wait before trying again.
Two-step sign-in
After your password, sjTasks asks for one more proof that it is you, so a stolen password is not enough on its own. A new account starts with a code by email: straight after you sign up we email a six-digit code, and the next page has one box for it. Typing it in confirms your address and makes that code your second step (see Starting a team); Choose another way on the same page picks an app or a text message instead. You can change it any time: Profile, under your name at the top right, then Sign-in codes and Change how you sign in. There are three ways:
- A code by email. Each time you sign in we email a six-digit code to your address and you type it in. This is the default, because every account has an address, and the first one also confirms your email address, so there is no separate link to click.
- A code by text message, where it is offered. Add your cell number and tick the box that agrees to texts. We text US and Canadian numbers only. Text messages has the rest, including how to stop.
- An authenticator app. We show a QR code; the app on your phone reads it and shows a six-digit code that changes every thirty seconds. Any authenticator app will do, and if you use a password manager it probably does this already. Type one code back to switch it on; that last step is what stops a half-finished set-up from locking you out. An app can be added only once your email address is confirmed; a code by email confirms it. With the app on, sign-in asks for the app's code rather than an emailed one.
Codes, and what happens when one goes wrong
A code works once, for ten minutes. Type it wrong five times and that code is dead: press Send a new code on the sign-in page and use the fresh one. If codes were texted to you and the text is slow, Email me a code instead is on the same page.
Ten wrong codes in an hour and no code works for the rest of that hour, not even a right one. We email you when that happens, because it usually means somebody has your password.
Recovery codes
Switching on the app, or texted codes, gives you eight recovery codes. Keep them where you keep your passwords. Each one signs you in once if you lose the phone: choose Use a recovery code on the sign-in page. Run low and you can make a fresh set under Profile; the old set stops working.
With codes by email there are no recovery codes, because your inbox is the second step, and Send a new code is the way back in.
Changing or stopping a step
Once you have a second step, moving it to another phone, switching to a different kind, or stopping codes asks for your password first. We email you each time it changes, so nobody who finds you signed in somewhere can quietly move your sign-in to their own phone. You cannot switch codes off while they are the only second step your account has.
A forgotten password
Press Forgot your password? on the sign-in page and tell us the address you sign in with. We email a link; follow it and choose a new password, at least twelve characters, typed twice. The link stops working after an hour, so ask for another if you left it too long.
Locked out
Lost the phone and the recovery codes too? Write to us through the contact form, giving your account's address. Once we have checked it is you, we reset your second step: your password stays, and the next time you sign in you choose a new one. We email you to say it was done, and why.
Signing out everywhere else
Left yourself signed in on a device you no longer use? Profile, then Where you are signed in, lists the browsers and devices with an open session. Sign out of other sessions asks for your password and closes every one but the one you are using. If you think somebody else has your password, change it as well.