Account security
Two-factor authentication, password rules, and what happens after repeated failed sign-ins.
Your Skeleton Key account has one optional protection you turn on yourself, two-factor authentication, and a few that are always on. This page covers both.
Two-factor authentication
Two-factor authentication adds a second step to sign-in: after your password, you enter a six-digit code from an authenticator app such as Google Authenticator, 1Password, or Authy. It is off by default and you can turn it on for your own account at any time.
- 01
Open your account settings
Click your avatar at the bottom of the sidebar and choose Settings. The Account Settings page opens. The Security section is at the bottom.
- 02
Start enrollment
On the Two-Factor Authentication card, click Enable two-factor authentication. A dialog shows a QR code and, below it, the same key as text in case you cannot scan.
- 03
Scan and confirm
Scan the QR code with your authenticator app, or type the key into it. Enter the six-digit code the app shows into the 6-digit code field and confirm. The card now reads Enabled with the date, and a toast confirms it.
From then on, every sign-in asks for a code after your password. If you open Skeleton Key in a new browser or after signing out, you will be asked for the code before the app opens.
To turn it off, click Disable two-factor authentication on the same card and confirm. Your account goes back to password-only sign-in, and you can re-enable it whenever you like.
Keep access to your authenticator app
There is no backup code. Keep the device holding your authenticator app, or the text key shown during setup, somewhere safe. Without one of them you cannot complete sign-in.
Passwords
When you sign up or reset your password, Skeleton Key checks the new password against known data breaches. A password that appears in a breach is rejected with the message "Password is known to be weak and easy to guess, please choose a different one." Pick something you have not used elsewhere.
Password reset links work when you submit the new password, not when you open the link, so an email scanner that follows links in your inbox will not burn the reset before you get to it.
Failed sign-ins
After ten failed sign-in attempts within fifteen minutes, the account is locked. The sign-in form then says "This account is locked. Reset your password to unlock it." Use Forgot password to set a new one; that clears the lock.
The sign-in, sign-up, and forgot-password forms may also show a short bot check before they accept your details.
Last updated: 2026-09-20