Password & Security
Password & Security, in the General menu, shows every way into your account in one place. Each row says what you have, what it does, and what you can do next. It covers the panel sign-in itself and the SSH keys that authorize shell and file-transfer logins.
This page is about your own account. Your domain users manage their credentials in the sign-in portal.
What the page shows
A section that doesn't apply to your account doesn't appear.
| Section | Holds |
|---|---|
| How You Sign In | Your passkeys and your password. Each is a complete way into your account. |
| Recent Activity | The sign-ins and security changes of the last 30 days. See Account Activity. |
| Second Steps | What the panel asks for after your password: the authenticator app, devices that approve a sign-in, backup codes, and trusted devices. See Second steps. Only while you have a password. |
| Improving Security | The changes that make your account safer and are open to you now, e.g. Go Passwordless, Enable Two-Step Verification, and Push Notifications. |
| Other Options | Things you can do but the panel doesn't recommend, e.g. Set a Password on an account that has none. |
| SSH Keys | The keys for SSH, SFTP, and SCP. See SSH keys. |
One line at the top of the page, repeated on the panel's home page, gives the most important thing to do now:
| The line says | Why |
|---|---|
| You have no backup codes left | You used them all. Make new ones. |
| Your account is protected by a password only | A password, no passkey, no second step. A stolen password is enough to sign in. |
| Consider going passwordless for more security | A passkey has signed you in at least once, so it works on your devices. You can remove your password now. |
| Your account is protected | Nothing more to do. |
Confirm that it is you
Before an action that changes how somebody can get into your account, the panel asks you to confirm your identity, even though you're signed in. A stolen session, or one somebody left open, can't add its own credentials that way.
These actions ask for it:
- change or set your password;
- add a passkey;
- set up, replace, or turn off the authenticator app;
- show or make backup codes;
- add a device, or let one approve your sign-ins;
- remove your password;
- download a private key.
Confirm with your password or a passkey; the page says which it accepts. The confirmation keeps these actions open for five minutes.
Two actions accept only a passkey:
- Remove your password. The confirmation proves your passkey works on this device. After the removal, a passkey is your only way in.
- Set a password on an account that has none. There's no password to confirm with.
After several wrong passwords, the confirmation page refuses further password attempts for a while. A passkey keeps working.
Your password
Your account password is your system password, the one the server checks for a password sign-in. It lives on the server, not in a panel database.
The panel can't show your password or email it to you. If you lose it, it can only be replaced. There's no "forgot password" email. See When you cannot sign in.
Your account controls the websites and the mail of whole domains. With a reset by email, each of those is only as safe as the mailbox that receives the reset.
Change your password
Select Change Password. After you confirm your identity, the form asks only for the new password, not the current one. So if you forgot your password but have a passkey, sign in with the passkey and set a new password here.
When you change your password, the panel:
- refuses a password that's on a public list of leaked passwords;
- signs out every other session, on every device; your current session continues;
- forgets every trusted device;
- emails your System Mailbox;
- adds a row to your account activity.
Your domain users' passwords and your SSH keys.
Passkeys
A passkey signs you in with your device's fingerprint, face, or PIN. You type no password, so there's nothing to phish and nothing to take from a list of leaked passwords. And it asks for no second step: the passkey does both steps at once, proving that you have your device and that you gave a biometric or a PIN.
The Passkeys page lists each passkey with:
| Column | Tells you |
|---|---|
| Device | Synced: a password manager or platform keychain keeps the passkey, so it works on your other devices too. Device-bound: the passkey can't leave the device where you made it. |
| Added | When you registered the passkey. |
| Last used | When it last signed you in or confirmed your identity, and from which address. |
A badge marks a passkey certified by the FIDO Alliance. A hardware-bound security key with this badge can't be copied to another device.
To register a hardware security key, open the menu beside Add Passkey and select Register a certified security key. The panel then asks the key to prove it's certified hardware.
E.g. one on your laptop and one on your phone, or a hardware security key kept in a safe place. A second passkey is the cheapest protection against the loss of a device.
Two safeguards:
- Deleting the passkey that signed you in to this session signs you out. The dialog says so before you confirm.
- You can't delete a passkey that is your last way into the account, i.e. when you have no password and no other passkey.
Go passwordless
Go Passwordless removes your password completely, leaving a passkey as the only way to sign in. Nobody can guess, steal, or leak a password that doesn't exist. The row appears under Improving Security once you have a passkey.
The panel also suggests it: the Passkeys page while you have a passkey, and the home page and Password & Security after a passkey has signed you in once. Not Now stops the suggestions; Go Passwordless stays available under Improving Security.
Go Passwordless opens a page that shows the result before anything changes:
- Your Passkeys: the passkeys that stay, with their last use. After the removal, they're your only way in.
- No Backup Passkey: shown when your only passkey can't leave its device. Add a backup security key before you continue.
- What Changes: the effects on your account.
- What Happens If I Lose My Passkey?: your hosting provider gives you a setup link.
To remove the password, confirm your identity with a passkey on that page.
Your account password is your system password, so this removes it. Anything that signs in with that password stops working, e.g. SSH or SFTP with a password; use an SSH key there. Nobody can bring the old password back.
After the removal:
- every other session is signed out;
- the Second Steps section disappears, since a sign-in with a passkey needs no second step;
- your authenticator app is kept but not used. It shows Not used under Other Options, and protects your sign-ins with a password again if you set a password.
To set a password again, select Set a Password under Other Options and confirm your identity with a passkey.
If you lose every passkey while you have no password, your hosting provider does the recovery, the same as for a lost password. See When you cannot sign in.
SSH keys
The panel also manages the public keys that authorize a login over SSH, SFTP, and SCP. Select Manage SSH Keys in the SSH Keys section.
An SSH key is separate from your panel sign-in. Adding a key doesn't change how you sign in to the panel, and removing your password doesn't change the keys.
The SSH page says what to connect to: the hostname, the port (probably not 22), the prepared commands, and the fingerprints of the server's host keys.