Account Security & Passkeys
Open Settings → Security to manage how you sign in and which devices can access your account. Available options depend on your sign-in method, device support, and whether passkeys are enabled for your account.
For changing your email or moving between password, Google, Apple, and passkey-only sign-in, see Changing Account Email & Sign-in Methods. Review that guide's MFA and session effects before switching.
If Chastify asks you to complete an identity check or you want to understand a profile badge, see Identity Verification & Profile Badges. Those checks are separate from sign-in security.
Which Setting Does What?
| Setting | What it does |
|---|---|
| Passkeys | Lets you sign in using a passkey saved on a device, in a compatible password manager, or on a security key. |
| Two-Factor Authentication | Adds an authenticator-code check. The app also calls this MFA. Backup codes provide an alternative when your authenticator is unavailable. |
| Advanced sign-in security | Requires two passkeys or security keys, disables weaker sign-in and email recovery, and provides recovery codes with a 48-hour wait. |
| Enhanced Login Security | Adds email verification to eligible password and passkey sign-ins when they are not recognized as trusted. |
| Active Sessions | Shows devices currently signed in and lets you sign them out. These are account sessions, separate from your lock sessions. |
| Biometric Login | In the mobile app, lets you use supported fingerprint or face authentication for saved sign-in credentials. |
| Biometric App Lock | In the mobile app, asks for biometric authentication after the configured inactivity period. |
Keep access to your account email and save any MFA backup codes somewhere you can reach if you lose your phone. A passkey and Biometric Login are separate features, even if both show a fingerprint or face prompt.
Add a Passkey
You can add a passkey to an existing password, Google, or Apple account without changing its existing sign-in method.
- Open Settings → Security → Passkeys.
- Choose Add a passkey and optionally give it a recognizable name, such as “My phone” or “Backup security key”.
- Verify your existing sign-in method. This may require your password, Google or Apple sign-in, an existing passkey, and an MFA code if enabled. If your account email needs verification, enter the emailed security code too.
- Follow your device or browser's prompt to create and save the passkey.
- Wait for Sign-in settings updated and check that the new passkey appears in the list.
The page supports up to 10 passkeys. You can use Apple Passwords, Google Password Manager, another compatible password manager, or a security key when offered by your device. Chastify stores the public key; the private key stays with your passkey provider.
If the page says your device is unsupported, use a compatible browser or update the mobile app. If Passkeys is missing entirely, the feature may not be enabled for your account.
Sign In With a Passkey
Choose Sign in with a passkey on the sign-in page and select your saved passkey. Approve the device's face, fingerprint, screen-lock, or security-key prompt. On a computer, the prompt may offer another device so you can use a passkey on your phone.
If Chastify then asks for an Authenticator or backup code or a Security code sent to your email, complete that step. Adding a passkey does not remove existing MFA or other required sign-in checks.
Manage Passkeys and Sign-In Methods
The passkey list shows each key's name, creation date, and last use. Use Rename or Remove and complete the verification prompt.
Removing a passkey stops it from working in Chastify and revokes sessions that used that key. Its saved copy may remain in your password manager until you remove it there too. A passkey-only account cannot remove its last passkey.
Switch to Passkey-Only Sign-In
After adding a passkey and verifying your email, you can choose Switch to passkey-only sign-in.
Switching removes your password or connected Google/Apple sign-in and signs out your other account sessions. You will need a passkey to sign in. Existing MFA remains enabled, and recovery still needs your account email. Before switching, check that your passkey works and consider adding a second passkey or security key.
A passkey-only account can use Add password sign-in on the Passkeys page after verification. The page also offers Switch to Google Sign-In and Switch to Apple Sign-In; follow the chosen migration flow to completion.
Advanced sign-in security
Open Settings → Security → Passkeys & security keys and add two different credentials. You can use a YubiKey plus another passkey, two synced passkeys, or two hardware keys. At least one must be a synced passkey or a verified hardware key that can be used on another device. Choose different devices or providers for a dependable backup; two copies of the same synced credential count as one.
Use Add a security key to verify supported FIDO2 hardware, such as a compatible YubiKey. Allow sharing its make and model; Chastify names verified hardware automatically. Keys previously enrolled as ordinary passkeys must be removed and enrolled again to verify their hardware.
Choose Enable advanced sign-in security, verify two credentials, save all eight recovery codes, and confirm the warning. This removes passwords, Google/Apple sign-in, authenticator MFA and its old backup codes, and email login codes. All sessions are signed out. Continue using the existing Sign in with a passkey button.
Keep a separate backup sign-in method and store your recovery codes somewhere safe, away from your sign-in devices. If you lose every credential and every recovery code, email and support cannot restore access. Anyone with a recovery code can start account recovery.
Recovery codes are separate from your hardware key: a YubiKey's private key is not exported. Save the codes as a file, write them down, or print the downloaded file. Chastify stores hashes of the codes and cannot show them again. Replace recovery codes creates a new set after passkey verification; saving and confirming it invalidates the previous set and cancels any pending recovery.
Recover with a saved code
- Open Trouble signing in? → Recovery code and enter your account email and one saved code.
- Wait 48 hours. Keep that same code; returning with it resumes the original request without restarting the wait. Chastify sends an email notice, but email cannot approve recovery.
- After the waiting period, return with the same email and code and add two replacement credentials. At least one must be a synced passkey or verified hardware key.
- Save the new recovery codes and confirm completion. All old keys, codes and sessions are revoked. Sign in with a replacement credential.
Complete recovery within seven days after the waiting period ends. Each code can start only one request. If the request expires or is cancelled, use a different unused code. Existing credentials keep working until recovery completes. An existing passkey can cancel the request in Security settings; replace all recovery codes if someone else may have them.
Turning off Advanced sign-in security requires passkey verification and restores ordinary passkey sign-in with email recovery. Old passwords, social sign-in and MFA are not restored; recovery codes and any pending request are invalidated.
Existing security-key-only accounts
Existing hardware-only accounts keep their policy. They can explicitly switch to Advanced sign-in security after verifying two registered hardware keys and saving recovery codes. Until they switch, ordinary device passkeys and recovery codes do not unlock the account, and losing every hardware key means losing access permanently.
Two-Factor Authentication and Backup Codes
- Open Settings → Security → Two-Factor Authentication and start setup.
- Scan the QR code with your authenticator app, or enter the Manual entry key there.
- Enter the authenticator's current 6-digit code in Chastify to complete setup.
- Save all eight backup codes shown after MFA is enabled. Each code works once; existing codes cannot be displayed again later.
Use an unused backup code at a sign-in prompt that accepts Authenticator or backup code if you cannot use your authenticator. Do not share your QR code, manual entry key, or backup codes.
If a sign-in request expires or your account settings change while entering an MFA code, start the sign-in again using your normal method. Repeated invalid attempts can also require a new sign-in request; follow the displayed wait time.
Replace backup codes or disable MFA
Return to Settings → Security and open Two-Factor Authentication or the MFA is enabled panel. Choose Generate replacement codes or Disable MFA. Passkey-only accounts label the replacement action Generate new backup codes.
| Sign-in method | Verification for these changes |
|---|---|
| Password | Current password and an authenticator code or unused backup code. |
| Google or Apple | Verify with the same connected account, plus an authenticator code or unused backup code. |
| Passkey-only | Verify with a passkey, then complete the MFA and any email-code prompt shown. |
For password, Google, and Apple accounts, choose Use a backup code to switch the code field when needed. New backup codes invalidate the whole previous set; save the replacement before closing the view. If replacement was submitted but the result was lost, the old codes may already be invalid. Reopen the current settings and generate another set after verification instead of relying on the old copy.
Enhanced Login Security and Trusted Devices
Enable Enhanced Login Security to add email verification when a password or passkey sign-in is not recognized as trusted. Enabling it remembers the current browser or app. Keep access to your account email so you can complete future checks.
For password sign-in, enabled MFA takes precedence: you complete MFA instead of the trusted-device email check. Passkey sign-in can request both MFA and an email security code. Google and Apple sign-ins use the provider flow and Chastify MFA if enabled, rather than this password-login device approval flow.
Once enabled, open the setting to review Trusted Devices. Remove entries you no longer use; the current device cannot be removed from its own list. Removing an entry clears its saved trust, but does not end existing sessions. Use Active Sessions separately to sign those out.
A saved device credential or a matching trusted city and country can avoid another email prompt. Removing one entry therefore does not guarantee that the next sign-in will need email verification. VPN or proxy use prevents location-based trust, but a remembered device credential can still be accepted. The absence of a prompt alone does not mean the setting is disabled.
If the mobile app asks for an update before managing trusted devices or approving a login, update it or use Chastify in a browser.
Verify a new login
When password sign-in pauses for device verification:
- Keep the initiating browser or app open.
- Enter the email's 6-digit code on that sign-in screen, or open the approval link from your email.
- Return to the browser or app where you started. It can continue after approval; if it does not, sign in again there.
The approval link does not sign you into the browser that opened the email. It approves the initiating login. This differs from the initial registration confirmation link described in Create Your Account.
Use the latest verification email. If the code expires or too many attempts are reported, start sign-in again and follow any wait time shown. If another verification is already in progress, finish it in the browser or app that requested it before starting another.
Review Active Sessions
Open Settings → Security → Active Sessions to review signed-in devices. The current device is marked This device. You can sign out individual sessions or use Logout All Other Devices to keep only the current session.
If you see an unfamiliar session, revoke it and review your sign-in credentials and passkeys. For a password account, use Change Password in Security settings. For Google or Apple sign-in, also review access to that provider account. Signing out an account session does not complete or release a lock session.
Change a password while signed in
Choose Settings → Security → Change Password, enter your current password and the new password twice, then submit. Check your account email and open the confirmation link to finish. Submitting the form alone does not change the password. If the link expires or the account's sign-in method changed meanwhile, start again from the current Security settings.
Biometric Login and App Lock
These options appear in the mobile app when supported by your device:
- Biometric Login: enable it, then sign in normally once to activate saved biometric login. Your device must have supported biometrics set up. Switching to passkey-only sign-in disables this saved-credential feature; use your passkey instead.
- Biometric App Lock: enable it to protect access to the open app. Under Lock after inactivity, choose Immediately, 30 seconds, 1 minute, 5 minutes, or 10 minutes.
App Lock protects access on that device. Manage other signed-in devices through Active Sessions.
Recover Account Access
Open Trouble signing in? from the sign-in page and choose the option that matches your account:
| Account type | Recovery route |
|---|---|
| Password account | Choose Reset password and follow the link sent to your account email. |
| Google account | Normally use Google and its account recovery. You can also request a Chastify password-reset link to switch this account from Google Sign-In to password sign-in. |
| Apple account | Use Apple Sign-In or Apple's account recovery. Chastify's password-reset flow does not recover an Apple-only account. |
| Passkey-only account | Choose Recover passkey access, verify your email, and create a replacement passkey. If MFA is enabled, an authenticator or unused backup code is also required. |
| Security-key-only account | Sign in with a registered backup hardware key. Email recovery is unavailable. |
Completing an email password reset revokes existing account sessions, signs you in again, and disables Chastify MFA if it was enabled. Set up MFA again and save the new backup codes. When the reset switches a Google account to password sign-in, it also removes Google sign-in and clears Enhanced Login Security and its trusted-device list; review those settings afterward.
Password-reset links expire after one hour. Request a new link if needed. The recovery screen's sent message does not confirm that the address has an eligible account; check the email address and use the recovery route for your actual sign-in method.
Enter the new password in both password fields. They must match before the reset is submitted; if they differ, correct them on the same form and submit again.
If you added passkeys while retaining a password or provider sign-in, use that existing method to access Passkeys and add a replacement. When adding it, Use my password or connected account instead lets you verify without the lost passkey.
For a passkey-only account with MFA enabled, access to email alone is insufficient: you also need the authenticator or an unused MFA backup code. This recovery flow preserves MFA.
Successful passkey-only recovery replaces every existing passkey and revokes all account sessions. It does not sign you in automatically. Return to the sign-in page and use the new passkey, completing MFA if enabled. Add any additional passkeys again afterward.
If a recovery code expires or setup fails, choose Start again to request a new code. If you cannot complete recovery, see Contacting Support and describe the error and sign-in method. Do not send passwords, security codes, or backup codes.
For initial registration, see Create Your Account.