> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Account security

> Set up multi-factor authentication, manage passwords, and control active sessions.

Truthlocks gives you tools to lock down your account: multi-factor authentication (MFA), password management, and session controls. Access these settings from your dashboard at `verify.truthlocks.com/security`.

## Multi-factor authentication

MFA adds a second verification step when you sign in. Truthlocks supports time-based one-time passwords (TOTP) through any authenticator app such as Google Authenticator, Authy, or 1Password.

### Enable MFA

<Steps>
  <Step title="Open security settings">
    Navigate to **Security** in your account sidebar, then click **Enable MFA**.
  </Step>

  <Step title="Scan the QR code">
    Open your authenticator app and scan the QR code displayed on screen. If
    you cannot scan the code, copy the setup key manually.
  </Step>

  <Step title="Enter verification code">
    Type the 6-digit code from your authenticator app and click **Verify &
    Enable**. MFA is now active on your account.
  </Step>
</Steps>

<Warning>
  Store your authenticator setup key in a safe place. If you lose access to
  your authenticator app, you will need to contact support to regain access to
  your account.
</Warning>

### Disable MFA

To turn off MFA, go to **Security**, click **Disable MFA**, and enter a valid 6-digit code from your authenticator app to confirm.

## Password management

Change your password from the Security page. Passwords must be at least 10 characters.

<Steps>
  <Step title="Enter your current password">
    Type your existing password to verify your identity.
  </Step>

  <Step title="Set a new password">
    Enter and confirm a new password (minimum 10 characters).
  </Step>

  <Step title="Save">
    Click **Change Password**. You remain signed in on your current session.
  </Step>
</Steps>

<Tip>
  Use a password manager to generate a strong, unique password for your
  Truthlocks account.
</Tip>

### Forgot your password

If you cannot remember your password, reset it from the sign-in page:

<Steps>
  <Step title="Click Forgot Password">
    On the sign-in page, click the **Forgot Password** link below the password
    field.
  </Step>

  <Step title="Enter your email">
    Type the email address associated with your account and click **Send Reset
    Link**.
  </Step>

  <Step title="Check your inbox">
    Open the password reset email and click the reset link. The link expires
    after a limited time.
  </Step>

  <Step title="Set a new password">
    Enter and confirm a new password (minimum 10 characters), then click
    **Reset Password**. You are redirected to the sign-in page.
  </Step>
</Steps>

<Info>
  For security, the confirmation message is always shown regardless of whether
  the email address is registered. This prevents account enumeration.
</Info>

## Session management

### Consumer portal sessions

The Security page lists all active sessions on your account, including the device, browser, and last-active time for each.

* **Review sessions:** Check for any sessions you do not recognize.
* **Sign out other sessions:** Click **Sign Out Other Sessions** to revoke all sessions except the one you are currently using. This is useful if you suspect unauthorized access.

<Info>
  Signing out other sessions does not change your password. If you believe your
  account is compromised, change your password and enable MFA.
</Info>

### Console sessions

Tenant administrators can view active console sessions from **Settings > Sessions** in the console. Each session entry shows:

| Field           | Description                                    |
| :-------------- | :--------------------------------------------- |
| **Device**      | The device name and browser used to sign in    |
| **Location**    | Approximate geographic location of the session |
| **Last active** | When the session was last used                 |
| **Current**     | A green badge indicates your current session   |

To revoke a session, click the session entry and confirm. The revoked user is signed out immediately.

Review this list periodically and revoke sessions you do not recognize to prevent unauthorized access to your tenant.

## Recommended security checklist

<CardGroup cols={2}>
  <Card title="Enable MFA" icon="shield-check">
    Protect your account with a second factor. TOTP-based MFA blocks
    unauthorized sign-ins even if your password is exposed.
  </Card>

  <Card title="Use a strong password" icon="key">
    Choose a password that is at least 10 characters and unique to Truthlocks.
    Avoid reusing passwords from other services.
  </Card>

  <Card title="Review sessions regularly" icon="desktop">
    Check your active sessions periodically and revoke any you do not
    recognize.
  </Card>

  <Card title="Keep your email secure" icon="envelope">
    Your email is used for password resets. Make sure it also has MFA enabled.
  </Card>
</CardGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Privacy center" icon="user-shield" href="/guides/privacy-center">
    Export your data or request account deletion.
  </Card>

  <Card title="Content protection" icon="lock" href="/guides/content-protection">
    Learn how to protect your content with cryptographic attestations.
  </Card>
</CardGroup>