> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reclaude.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Change your ReClaude password, enable two-factor authentication (MFA) with TOTP, save recovery codes, and review or revoke active sessions.

Where to find it: dashboard nav → **Settings**.

## Change your password

**Settings → Security → Change password**. Requirements:

* At least 12 characters
* Must include uppercase, lowercase, digits, and symbols
* 72 characters or fewer

After a successful change, **your current browser session stays signed in**, but ReClaude revokes every other session on your other devices and browsers.

## Forgot password

On the sign-in page, click **Forgot password?**, get a 6-digit code by email, and set a new password.

## Two-factor authentication (MFA)

When enabled, signing in on a new device requires a 6-digit code from your authenticator app.

### Enable

1. **Settings → Security → Two-factor authentication → Enable MFA**.
2. Scan the QR code with Google Authenticator, 1Password, etc. (or copy the secret manually).
3. Enter a 6-digit code to confirm.
4. The screen will show **10 one-time recovery codes** — download or save them now.

<Warning>
  Recovery codes are shown only once. If you lose your device and don't have them saved, you'll be locked out and will need to verify identity through a ticket to recover.
</Warning>

### Disable

Enter your **current password + a TOTP or recovery code** to disable.

### Regenerate recovery codes

If you've used some, or worry someone may have seen them, **regenerate** them. Regenerating immediately invalidates the old set and gives you a fresh one.

## Active sessions

**Settings → Sessions** lists every active session across browsers / devices for this account, with IP, creation time, and last activity time.

* Click **Revoke** to drop a session immediately.
* Signing out of the current browser via the account menu's **Sign out** has the same effect as revoking the current session here.