# Security

The **Security** settings live at **Settings → Security** (in the top-right menu, under the **Set up** group). The page holds two cards side by side: **Password** and **Two-factor authentication**. A third card, **Passkeys**, is planned and will appear on the same page when it ships.

## Password

The **Password** card lets you change the password you use to sign in.

| Field | Notes |
| --- | --- |
| **Current password** | The password you currently sign in with. |
| **New password** | Your new password. |
| **Confirm new password** | Re-type the new password. |

Click **Update password** to save. The card description reads: *Change the password you use to sign in.*

## Two-factor authentication

The **Two-factor authentication** card controls whether signing in requires a one-time code from an authenticator app, in addition to your password.

- **Turn on two-factor authentication** — open the card and follow the prompts. You will scan a QR code with an authenticator app (Authy, 1Password, Google Authenticator, etc.), enter the first 6-digit code it shows, and save your recovery codes in a safe place.
- **Turn off two-factor authentication** — click the toggle, then confirm by entering a fresh 6-digit code from your authenticator app and clicking **Disable**. The confirmation step is required so a stolen session cannot silently disarm 2FA.

The card description reads: *Sign-in methods and protections for your Anboto account.*

!!! tip "Recovery codes"
    When you turn 2FA on, Anboto shows a one-time list of recovery codes. Store them in your password manager: each one lets you sign in once if you lose your authenticator. They are not shown again.

!!! note "Old URLs redirect here"
    The legacy `/settings/password` and `/settings/two-fa` URLs redirect to this page; if you have them bookmarked, update the bookmark to `/settings/security`.

## See also

- [API Key Security](../reference/api-key-security.md) — the permissions, rotation, and storage of the API keys you use to link your exchange accounts.
- [Teams & Accounts](teams-and-accounts.md) — the **Account details** window, where a team admin can switch a member between **Trade** and **View only**.