Signing in: email, Google or Apple — and connecting more than one

You can sign in with an email address and password, or with Google or Apple. Creating an account by email asks for a 6-digit code from the email we send, so we know the address is yours.

One account, several ways in

If your Google or Apple account uses the same email address you signed up with, signing in that way opens the same account. If it uses a different address — Apple's Hide My Email, say, or a second Google account — connect it under Account → Connected sign-ins while you're signed in. From then on either way in reaches the same pages.

Email and password can't be disconnected; a Google or Apple sign-in can be, as long as one other way in remains.

Forgotten password

Choose Forgot your password? on the sign-in page and we'll email you a link to set a new one.

Keep me signed in

The box on the sign-in page is ticked to begin with: this browser stays signed in until you sign out — closing it, or restarting the computer, doesn't ask you again. Untick it on a computer that isn't yours — at the library, a friend's laptop — and closing the browser is the same as signing out. Either way, Account → Sign out of all other devices ends every session but the one you're on.

If you think someone else has been in your account

Change your password — under Account → Change password, or through Forgot your password? — and every other device and browser is signed out at the same moment; only the one you're using stays. You can also do that on its own: Account → Sign out of all other devices. Then turn on Two-step verification, and if you reuse that password anywhere else, change it there too.

Where you're signed in

Under Account there is a list of every device and browser with your account open — Safari on iPhone, Chrome on Windows, the Beyond My Time app — with when it was last used. Sign out of any you don't recognise, one at a time, then change your password.

Two emails we send without being asked

• "New sign-in to your account." The first time your account is opened from a device we haven't seen — a new phone, a different browser — we email you. If it was you, there's nothing to do. We don't send it for the very first device, or when a browser merely updates itself.
• "You just invited N people — was that you?" If ten or more invitations go out from your account inside an hour, we email you once with one button: That wasn't me. It withdraws every invitation your account sent that day and signs it out of every device — then you set a new password. If it was you, ignore the email; nothing changes.