Account Security
Your SingleSign account is the key to every app you sign in to, so keeping it secure is essential. This overview covers the tools available to protect your account.
Why security matters
If someone gains access to your SingleSign account, they could potentially sign in to every app you've connected. That's why we provide multiple layers of protection to keep your account safe.
Multi-factor authentication (MFA)
MFA adds a second layer of verification beyond your password. After entering your password, you'll be asked to provide a time-based code from an authenticator app on your phone. Even if someone steals your password, they can't sign in without your authenticator.
We strongly recommend enabling MFA. Learn how to set up MFA →
Backup codes
Backup codes are one-time emergency codes that let you sign in if you lose access to your MFA device. When you enable MFA, you should generate and securely store a set of backup codes.
Devices & sessions
The Devices page shows you every active session on your account — including the device type, browser, approximate location, and last activity time. If you see a session you don't recognize, you can sign it out immediately.
Recovery options
Recovery options help you regain access to your account if you lose your password or MFA device. You can set up recovery contacts (trusted email addresses) and generate backup codes.
Security checklist
Use this checklist to make sure your account is well-protected:
- ✅ Strong, unique password — at least 8 characters including a symbol, not reused from other sites.
- ✅ MFA enabled — using a TOTP-compatible authenticator app.
- ✅ Backup codes stored securely — in a password manager or a printed copy in a safe place.
- ✅ Recovery contacts configured — trusted email addresses that can help you regain access.
- ✅ Active sessions reviewed — no unrecognized devices or locations.
- ✅ Connected apps reviewed — only apps you recognize and use. Manage connected apps →
Last updated: 2026-02-16
Related articles
- Help CenterFind answers about using SingleSign to sign in, manage your privacy, and secure your account.
- Creating an Account, step by stepHow to create a free SingleSign account: pick an address, set a password, verify it, and turn on multi-factor authentication.
- free identity providerSingleSign pricing in one line: sign-in is free, with no monthly-active-user meter. See exactly what is included, and what SingleSign Mail costs for businesses.
- Identity provider alternativesIdentity provider alternatives, by the provider you are leaving: what actually has to change in your code, and what does not.
- Auth0 comparisonSingleSign vs Auth0 compared on the difference that matters: who owns the account. A side-by-side table, then the three cases where each one is the right call.
- Okta comparisonSingleSign vs Okta: Okta is built for workforce identity inside a company, SingleSign for consumer sign-in across applications.
- SingleSign vs Firebase AuthenticationSingleSign vs Firebase Authentication on lock-in, portability and consent, plus the cases where staying on Firebase is right.
- Google Sign-In alternativeSingleSign vs Google Sign-In: the same one-tap convenience, without an advertising business behind the identity.
- alternative to Auth0Auth0 alternatives compared, plus the part most listicles skip: what migrating off Auth0 actually involves, which code changes, and which does not.
- Okta alternativesOkta alternatives for teams that need customer sign-in rather than workforce identity. The table first, then what changes when you move consumer auth off Okta.
- alternative to Firebase AuthFirebase Authentication alternatives for teams leaving Google Cloud or wanting a standalone OIDC provider. Comparison table, then the real migration path.
- SaaS single sign-onSSO for SaaS applications using OAuth 2.0 and OpenID Connect: the flow to pick, the scopes to request, and a working integration path with SingleSign.