Account settings

Open Settings → Account to manage your email address, password, passkeys and signed-in sessions, or to close your account.

Verify or change your email

After signing up, open the link in the verification email. Until your address shows Verified, you cannot create or import repositories. Send verification message sends a fresh link.

To change your address, choose Change email, confirm it's you, and open the link sent to the new address. Your current address stays active until then.

Change your password

Enter your current password and a new one of at least 12 characters, twice. Changing your password signs out every other session. If you have forgotten it, see password recovery.

Use passkeys

Passkeys let you sign in without a password and confirm sensitive changes.

Add passkey asks for a label, then runs your browser's passkey prompt. You can have up to 20.
Each passkey shows whether it is Synced across devices or Device-bound, and when it was added and last used. Rename it with the pencil or delete it with the bin.
A Counter anomaly badge means the passkey may have been copied; delete it.

Require a passkey turns off password sign-in and email password recovery for your account. Before you turn it on, make sure you can always reach a passkey, then generate recovery codes.

With Require a passkey on, Generate recovery codes creates eight one-time codes for getting back in if you lose every passkey. They are shown once: save them somewhere safe and offline. Generating a new set, or turning the passkey requirement off and on, invalidates the old codes. See password recovery.

Confirm it's you

Sensitive changes, such as adding a passkey, creating a token or changing your email, need a recent confirmation. When needed, a Confirm it's you dialog asks for a passkey or your password. The confirmation lasts 10 minutes with a password and 15 with a passkey, and the action you started continues on its own.

Manage signed-in sessions

Active sessions lists every signed-in browser with when it was created, last used and expires. This device marks the current one.

Revoke signs out one other session.
Sign out everywhere else signs out all other sessions.

If a broken cookie keeps you from signing in, open Sign in → Trouble with this browser's session? → Reset browser session, then sign in again. This signs out only this browser.

Close your account

Closing your account signs you out everywhere, revokes your tokens, keys and passkeys, and archives your account. Your past issues and comments keep your name.

You can close an account only when it has nothing left in it:

no personal repositories (transfer them first; deleting them is not enough),
no organization memberships (ask an owner to remove you, and hand over ownership of organizations where you are the only owner),
no billing history.

Choose Close account, confirm it's you, and type your handle. The page lists anything that still blocks closure.