# Account settings

Open **Settings → Account** to manage your email address, password, passkeys
and signed-in sessions, or to close your account.

## Verify or change your email

After signing up, open the link in the verification email. Until your address
shows **Verified**, you cannot create or import repositories. **Send
verification message** sends a fresh link.

To change your address, choose **Change email**, confirm it's you, and open the
link sent to the new address. Your current address stays active until then.

## Change your password

Enter your current password and a new one of at least 12 characters, twice.
Changing your password signs out every other session. If you have forgotten it,
see [password recovery](https://staging.git.cafe/docs/account/password-recovery.md).

## Use passkeys

Passkeys let you sign in without a password and confirm sensitive changes.

- **Add passkey** asks for a label, then runs your browser's passkey prompt.
  You can have up to 20.
- Each passkey shows whether it is **Synced** across devices or
  **Device-bound**, and when it was added and last used. Rename it with the
  pencil or delete it with the bin.
- A **Counter anomaly** badge means the passkey may have been copied; delete it.

**Require a passkey** turns off password sign-in and email password recovery
for your account. Before you turn it on, make sure you can always reach a
passkey, then generate recovery codes.

### Recovery codes

With **Require a passkey** on, **Generate recovery codes** creates eight
one-time codes for getting back in if you lose every passkey. They are shown
once: save them somewhere safe and offline. Generating a new set, or turning
the passkey requirement off and on, invalidates the old codes. See
[password recovery](https://staging.git.cafe/docs/account/password-recovery.md#recover-a-passkey-only-account).

## Confirm it's you

Sensitive changes, such as adding a passkey, creating a token or changing your
email, need a recent confirmation. When needed, a **Confirm it's you** dialog
asks for a passkey or your password. The confirmation lasts 10 minutes with a
password and 15 with a passkey, and the action you started continues on its
own.

## Manage signed-in sessions

**Active sessions** lists every signed-in browser with when it was created,
last used and expires. **This device** marks the current one.

- **Revoke** signs out one other session.
- **Sign out everywhere else** signs out all other sessions.

If a broken cookie keeps you from signing in, open **Sign in → Trouble with
this browser's session? → Reset browser session**, then sign in again. This
signs out only this browser.

## Close your account

Closing your account signs you out everywhere, revokes your tokens, keys and
passkeys, and archives your account. Your past issues and comments keep your
name.

You can close an account only when it has nothing left in it:

- no personal repositories (transfer them first; deleting them is not enough),
- no organization memberships (ask an owner to remove you, and hand over
  ownership of organizations where you are the only owner),
- no billing history.

Choose **Close account**, confirm it's you, and type your handle. The page
lists anything that still blocks closure.