> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account security

> Sign in, reset your password, set up two-step verification, verify your phone for paging and sign out of Pharus.

<Info>
  **Plans:** Every plan, and Free. **Who:** everyone. Two-step verification is required for owners and admins who sign in with a password.
</Info>

Your Pharus account is one sign-in for every company you belong to. Owners and admins protect the whole company, so Pharus asks them for a code from their phone on top of the password.

## Sign in

Go to [the sign-in page](https://app.pharussecurity.com/sign-in?lang=en) and enter your **Work email** and **Password**, or select **Sign in with Microsoft** or **Sign in with Google** where the page shows them.

* **Remember this device** is ticked by default. Untick it on a shared computer.
* A link in a page SMS opens the incident straight after sign-in.
* If your address isn't confirmed yet, Pharus sends a new confirmation link instead of signing you in. See [Confirm your email address](/workspace/sign-up#confirm-your-email-address).

When two-step verification is on, the next page asks for the 6-digit code from your authenticator app.

* **Trust this device for 30 days** skips the code on this device for 30 days.
* **Use a backup code instead** takes one of your backup codes. Each code works once.
* After 10 wrong codes, wait 15 minutes. If the code page times out, sign in again.

## Reset your password

<Steps>
  <Step title="Ask for a link">
    On the sign-in page select **Forgot password?**, enter your work email and select **Send reset link**.
  </Step>

  <Step title="Open the email">
    If the address has a Pharus account, an email **Reset your Pharus password** is on its way. Its link works for 1 hour and only once.
  </Step>

  <Step title="Choose a new password">
    Enter a **New password** of at least 12 characters, repeat it and select **Save new password**. Your other sessions are signed out.
  </Step>
</Steps>

There is no separate screen for changing your password: to change it, use **Forgot password?**. If you didn't ask for a reset, ignore the email. Your password stays the same.

## Set up two-step verification

Two-step verification adds a code from an authenticator app on your phone each time you sign in with email and password. You'll need an app such as Microsoft Authenticator, Google Authenticator or 1Password.

<Steps>
  <Step title="Open Settings → Security">
    Under **Two-step verification**, select **Set up**.
  </Step>

  <Step title="Confirm it's you">
    Enter your password and select **Continue**.
  </Step>

  <Step title="Scan the QR code">
    Scan it with your authenticator app. If the app can't scan it, type in the key the page shows instead.
  </Step>

  <Step title="Enter the first code">
    Type the **6-digit code** from the app and select **Turn on**. If the code is refused, check that the time on your phone is right.
  </Step>

  <Step title="Save your backup codes">
    Each code signs you in once if you lose your phone. **Copy** or **Download** them, keep them somewhere safe such as your password manager, tick **I've saved the backup codes** and select **Done**. They won't be shown again.
  </Step>
</Steps>

Turning it on signs you out on every other device.

### Owners and admins

Two-step verification is required for owners and admins who sign in with a password. If yours isn't set up, Pharus shows **Set up two-step verification** after you sign in, before any other page, and takes you on to the page you were going to once it is on. Until then the only other way out is **Sign out**.

This also applies when you create a company, because you become its owner, and when someone makes you an admin or owner.

### New backup codes and turning it off

Under **Settings → Security**:

* **New backup codes** gives you a new set after you confirm your password. The new set replaces the old one.
* **Turn off** removes two-step verification after you confirm your password. Owners and admins are asked to set it up again straight away.

## If you sign in with Microsoft or Google

If you sign in through Microsoft or Google without a Pharus password, your sign-in provider handles two-step verification, and **Settings → Security** says so. Pharus asks for its own code only at password sign-ins.

If you set a password with **Forgot password?**, you can sign in with it too, and the two-step rule for owners and admins applies to you.

If the sign-in page says "That Microsoft or Google sign-in isn't connected to your Pharus account", sign in with your email and password. Use **Forgot password?** if you don't have one.

## Verify your phone number for paging

Pharus pages whoever is on call by SMS, and only to a verified number. See [On-call rota](/on-call/rota).

<Steps>
  <Step title="Add your number">
    Open **Settings → Your profile**, enter your **Mobile number** in international format, for example +47 912 34 567, and select **Save profile**.
  </Step>

  <Step title="Send a code">
    Under **Paging**, select **Send code**. The SMS code expires in 10 minutes.
  </Step>

  <Step title="Verify">
    Type the **Code from the SMS** and select **Verify number**. The status changes to **Verified** with the date.
  </Step>
</Steps>

You can ask for 3 codes in 15 minutes. A new number has to be verified again before you are paged. Your profile, number included, is set per company: verify it in each company where you are on call.

## Sessions and signing out

To sign out, select the sign-out icon next to your name at the bottom of the sidebar. That ends your session in this browser.

These end your sessions everywhere else as well:

* resetting your password
* turning on two-step verification
* deleting your account ([Data and deletion](/workspace/data-and-deletion#delete-your-account))

When an owner or admin removes you from a company, you lose access to that company straight away.

## How Pharus protects sign-in

Passwords have at least 12 characters. Pharus limits how many sign-in, sign-up, password-reset and confirmation-email requests one network address can make, and how many two-step codes can be tried. New sign-ups pass a bot check run by Cloudflare. Confirming an email address takes a button press, so link scanners in mail systems can't confirm it, and neither sign-up nor password reset tells anyone whether an address has an account.

## Related

<CardGroup cols={2}>
  <Card title="Sign up" icon="user-plus" href="/workspace/sign-up" />

  <Card title="Members and roles" icon="users" href="/workspace/members-and-roles" />

  <Card title="Paging" icon="siren" href="/on-call/paging" />

  <Card title="Data and deletion" icon="database" href="/workspace/data-and-deletion" />
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.