# Account security

> Passwords, passkeys, two-factor authentication, recovery codes, appearance and language.

## Signing in

Sign in with your email and password, a **passkey**, or GitHub/Google. Under **Settings → Security**:

- **Update password**: use a long, random password; passwords found in known breaches are refused.
- **Passkeys**: **Add passkey** to sign in without a password from that device (Face ID, Touch ID, Windows Hello, a security key). Name each one so you recognize it later; **Remove** deletes it.
- **Two-factor authentication**: **Enable 2FA**, scan the QR code with an authenticator app (or enter the key manually) and confirm with a code. From then on, signing in with a password asks for a 6-digit code.
- **Recovery codes**: shown when you enable 2FA; **View recovery codes** and **Regenerate codes** later. Store them in a password manager — each works once if you lose your authenticator.

## Approval passkey

Separate from your sign-in passkeys, the **approval passkey** confirms high-risk actions and is held by Zefily's separate signing service. See [Approvals and passkeys](/docs/approvals).

## Confirming sensitive views

Revealing secrets — an admin login, a database password, the `.env`, a backup repository password — asks you to confirm your password (or passkey) again if you have not done so recently, and is written to the audit log.

## Appearance and language

- **Settings → Appearance**: light, dark or system theme.
- The language button at the top of every page switches between English and Turkish; your choice is remembered for your account and used for emails too.

## Profile and account deletion

**Settings → Profile** changes your name and email address (a new address must be verified). **Delete account** removes your account and the organizations you alone own; it asks for your password.

---
Source: https://zefily.com/docs/account-security