Sign-in and security

#Ways to sign in

#Create an account with email

1. 1

   Step 1: Enter your details

   On "Create your account", type your first name (required), last name (optional) and email, then select Continue. If the email already has an account you see "This email is already registered. Log in instead."

2. 2

   Step 2: Choose a username and password

   The username takes letters, numbers and underscores, at least 3 characters. The password needs at least 8 characters, typed twice. Select Create account. UOVA emails you a code.

3. 3

   Step 3: Enter your code

   The code has 8 characters: the digits 0 to 9 and the letters A to F. Type it and select Verify. Use Resend code if it does not arrive.

4. 4

   Step 4: Choose whether to hear from UOVA

   The last screen says "You're in." Subscribe adds your email to UOVA's mailing list for new tools, features and offers. Not now skips it. Your account exists either way.

Sign-up codes are limited to 3 requests a minute from one network address. See Emails from UOVA for what the email looks like and where it comes from.

#Log in

On "Log in to UOVA" enter your email and password and select Log in. After several failed attempts the window may ask you to pass a Cloudflare check before it tries again. There is no magic-link sign-in.

#Reset a forgotten password

1. 1

   Step 1: Select Forgot password?

   It is on the log-in window. The next screen reads "Reset your password".

2. 2

   Step 2: Enter your email

   UOVA says "If an account exists for <email>, you'll get a link to reset your password shortly." The message is the same whether or not the address has an account.

3. 3

   Step 3: Open the link

   It opens "Choose a new password". Type at least 8 characters twice. When it works the page reads "Password updated".

• The link works once, and only the newest link works. Resend link is disabled during a countdown ("Resend in <n>s") after each send, and Use a different email goes back a step.
• If the page says "This reset link has expired or was already used.", select Send a new link.
• Check spam or promotions if nothing arrives. Reset requests are limited to 5 a minute from one network address.

#Change your password

Open Account settings > Security > Password. Enter a new password of at least 8 characters, confirm it, and save. You see "Use at least 8 characters." or "The two passwords don't match." for the two mistakes. Changing it signs out your other devices and keeps you signed in here. A Google-only account shows "You sign in with Google, so there's no password to change."

#Two-factor sign-in

Two-factor sign-in asks for a 6-digit code from an authenticator app each time you sign in, so a password alone cannot open your account. Set it up in Account settings > Security > Two-factor authentication.

1. 1

   Step 1: Select Set up

   A dialog shows a QR code and a setup key.

2. 2

   Step 2: Scan the code

   Use an authenticator app such as 1Password, Google Authenticator or Microsoft Authenticator. If you cannot scan, type the setup key in groups of four. Copy the key into your password manager too.

3. 3

   Step 3: Enter the 6-digit code

   Type the current code the app shows for UOVA and select Turn on. The status then reads On.

• From then on, signing in asks for a code on "Enter your code" after your password or sign-in provider. A full six digits submits by itself, and a wrong one shows "That code didn't work. Enter the newest code from your app."
• Browsers that were already signed in are asked for a code within the hour. To ask them now, use Sign out everywhere.
• Add a backup device registers a second phone or app that can give you codes if you lose the first. Each device can be removed. Removing the last one asks "Turn off two-factor?".

#Sign out

In Account settings > Security > Sessions, Sign out ends this browser's session. Sign out everywhere asks "Sign out of all devices?" and then ends every session, this one included, so use it if you signed in on a computer that is not yours. Log out in the account menu also signs you out.

#What is not supported

• Magic-link sign-in.
• Changing your account email yourself (contact support).
• Two-factor recovery codes.
• A list of your active sessions.
• A profile photo.