Security and two-factor authentication

Your isituprightnow account controls what is monitored and who gets woken up at night, so it deserves more than a password. Everything below is in Settings → Security. For how we protect data on our side, see Security.

Two-factor authentication (2FA)#

With 2FA on, signing in needs your password and a 6-digit code from an authenticator app on your phone (TOTP), such as Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden or Aegis.

Turn it on#

1. Go to Settings → Security and choose Set up authenticator app.
2. Scan the QR code with your app. Can't scan it? Type the key shown under the code instead.
3. Enter the 6-digit code from the app to confirm.
4. Save your recovery codes (see below), then confirm that you have saved them.

From now on, every sign-in — with a password or with Google, on the web or in the mobile app — asks for a code.

Recovery codes#

When you enable 2FA you get 10 one-time recovery codes. Each code can replace an authenticator code once, for example when you lose your phone.

• Store them somewhere safe and separate from your phone: a password manager, or printed.
• Used codes don't work again. Generate a new set at any time in Settings → Security; the old set stops working.
• Lost your phone and your recovery codes? Contact support from the account's e-mail address. For your safety we verify that the request comes from the account holder before removing 2FA.

Turn it off#

You can disable 2FA in Settings → Security with a current code. If your account's owner requires 2FA for the team, you can't use the account without it.

Sessions#

Every browser and every mobile device you signed in with is a session. Settings → Security → Sessions lists them with the device, IP address and last use.

• Revoke a session you don't recognise; that device is signed out immediately.
• Sign out all other sessions keeps only the current one.
• Changing or resetting your password also signs out all other sessions.

Passwords#

• Passwords need at least 10 characters with at least 4 different characters. Longer passphrases are better.
• We store only a salted hash of your password, never the password itself.
• Forgot your password? Use Reset password. The reset link also confirms your e-mail address and signs out every session.
• Signed up with Google? You can add a password in Settings → Security to sign in without Google as well.

Lockout#

After 5 failed sign-in or 2FA attempts the account is locked for 15 minutes. This slows down password guessing; wait and try again, or reset your password.

API keys#

API keys give programmatic access to your account. They are shown once, stored only as hashes, can be read-only and can be revoked at any time. See API keys.

Report a vulnerability#

Found a security issue? Please report it privately through the contact form with the topic "Security". Our disclosure policy is on the Security page and in /.well-known/security.txt.