All guides

How you sign in

There are four ways into your account, and you can use more than one. This explains what each is good for, which to pick, and how to get back in when something goes wrong.

~5 minutes

Everything here lives in one place: Settings → How you sign in. That panel shows what is set up on your account and lets you add or remove things. It will not let you remove your last way in.

The four ways in

Password

The one every account starts with. Works everywhere, including on a machine that isn't yours. Slow to type on a phone, which is the whole reason the other options exist.

Google

One tap, no password to remember. If you already had an account with the same email address, connecting Google links to it rather than making a second one — your subjects and comments stay exactly where they were.

Passkey — Face ID, Touch ID, Windows Hello

The fastest, and the one worth setting up if you use Comment Coach on your phone. Instead of a password you use whatever already unlocks the device. There is nothing to remember and nothing that can be typed into a fake website by mistake.

Most passkeys sync. If you use iCloud Keychain or a password manager, one created on your iPhone works on your Mac too. The list in Settings tells you which kind each one is.

Two-step verification

A six-digit code from an authenticator app, asked for after your password. It means a stolen password on its own is not enough. Turning it on gives you ten backup codes — more on those below, because they are the part people regret ignoring.

Which should you use?

  • On a phone: add a passkey. It turns signing in from a chore into a glance.
  • Sharing a computer, or want a second lock: turn on two-step verification.
  • Either way, keep your password. It is the fallback that works when a device is lost, and Settings will not let you remove your only way in.

Your backup codes

When you turn on two-step verification we show you ten codes, once. Each works a single time, and they are how you get in if your phone is lost, stolen, or wiped. Copy or download them before you finish setting up — the button that continues stays greyed out until you confirm you have, on purpose.

Keep them somewhere that is not your phone. Backup codes stored only on the device that holds the authenticator solve nothing: the situation they exist for is the one where you no longer have that device.

If you can't get in

  • Forgotten password. Use reset your password. If Google is connected you can also just use that.
  • Lost the phone with your authenticator. Sign in with your password, then enter one of your backup codes instead of a six-digit code.
  • Lost the authenticator and the backup codes. Email us. This one needs a human, and proving who you are is the point — it would be a poor second factor if a message could switch it off.
  • Your passkey isn't offered. Check the web address first. A passkey belongs to one site, so one created on our test site will not work on the real one.
  • A password you are sure of is refused. If your password manager filled the field, it may be holding an older password — clear the box and type it by hand.
  • New phone. If your passkeys sync, they came with you. If not, sign in with your password and add a new one.

If you use the Home Screen app on iPhone

iOS clears saved data for Home Screen apps from time to time, which signs you out even though nothing is wrong with your account. A passkey turns that from a password on a phone keyboard into a glance at Face ID. See iPhone & iPad for what iOS is actually doing and why.

Nothing here can lose your work. Your comments, subjects and settings live on your account, not on the device. Being asked to sign in again is an inconvenience, never a loss.