Account security

Two-factor authentication adds a second check at sign-in. Someone with only your password cannot access your account.

Complete email verification in the browser where you signed up. If you use a different browser, set a new password after verification. This replaces the password from the original signup and ends its existing sessions.

Set up one or two options in Account.

• Authenticator app. Six-digit codes from an app such as 1Password, Apple Passwords, Authy, or Google Authenticator. No fingerprint reader needed.
• Passkey. Sign in with your device's fingerprint, face, or PIN instead of typing a password.

1. Open Account and select Set up under two-factor authentication.
2. Scan the QR code with your authenticator, or enter the key manually.
3. Enter the six-digit code from the authenticator app.

Future sign-ins ask for your password, then a current code. Each code expires quickly and works once.

You can set this up in the desktop app, phone app, or browser.

Open full size

In a supported browser, open Account and select Add a passkey. If you signed in more than 10 minutes ago, enter your current password first. Complete the fingerprint, face, or PIN check on your device. For later sign-ins, select Sign in with a passkey. Your password stays available too.

To add a passkey from the desktop app, select Add one in a browser. Phone apps cannot add passkeys. Existing passkeys work for sign-in through the browser. You can see and remove passkeys inside the apps.

When you add your first authentication factor, Screencake shows ten account recovery codes once. Save these codes in a different location from your sign-in device. Each code can replace the second-factor check once. More passkeys use the same account recovery codes.

Email cannot reset your second factor. If you lose your authenticator and passkeys, use an account recovery code. If you also lose the codes, contact us.

A new set invalidates all previous account recovery codes. To replace the codes, generate a new set in Account. Replace your saved copy with the new codes.

Workspace owners can enable Require two-factor authentication under Workspace settings → Security. Either an authenticator app or a passkey meets the requirement.

The requirement takes effect immediately. Before you enable it, tell your team. Users without a factor see setup on their next visit. The switch shows how many users have no factor.

Set up your own factor before enabling the requirement. It is applicable to each role, including production-only collaborators. If one of your workspaces enforces two-factor authentication, you must complete the check.

On Studio, workspace owners can set five rules in Workspace settings → Security. If the workspace changes to a different plan, these rules are no longer active.

• Guest links must have a passcode. The app rejects new links without a passcode.
• Guest links never offer a download. Guests read in the browser. PDF downloads are unavailable, including through existing links.
• Guest links expire after 7, 30 or 90 days. New links have this limit. Existing links do not change.
• Encrypted scripts only. A plaintext script in the workspace cannot be shared by link or exported until it is encrypted.
• Everyone signs in again each 1, 7 or 30 days. Older sessions end, including active collaboration connections. Signing in to an app through an existing browser session does not restart this period.

The rule does not encrypt scripts automatically. The script owner must enable encryption in the editor. Until then, the script stays readable. Before confirmation, examine the listed feature and data changes. Refer to Encrypted scripts.

Studio workspaces also support single sign-on. Refer to Single sign-on.

To remove an authenticator or your last passkey, enter your password. Adding a factor signs out your other sessions. A password change also signs out your other sessions.

Open Account → Active sessions to see where you are signed in. Select Revoke beside a session to sign it out.

To sign out all other sessions, select Sign out other sessions. Your current session stays signed in.

Revocation also disconnects active collaboration connections for that session.

Two-factor authentication protects account access. Encryption prevents the server from reading script content. Script keys are shared with a hybrid post-quantum key exchange (ML-KEM-768 with P-256). Its recovery key is different from account recovery codes. Your password can unlock encryption on a new device. After a password reset, use the encryption recovery key. See Encrypted scripts.