Use case: You want to make sure only you can get into your ManyRequests account: change a weak password, add a code from your phone at sign-in, and sign out of a laptop you no longer use.
Everyone with a ManyRequests account (portal admins, admins, team members and clients) has a Security tab with three sections: Password, Two-factor authentication and Browser sessions.
Open your security settings
Click your name at the bottom of the sidebar and choose Your profile, then open the Security tab. Portal admins and admins can also go to Settings > Profile and account > Security.
Change your password
Under Password, enter your Current password.
Enter a New password (minimum 8 characters) and repeat it in Confirm new password.
Click Update password. You'll see Password updated. when it's done.
Forgot your current password? Sign out and use the forgotten password link on the sign-in page instead.
Turn on two-factor authentication (2FA)
With 2FA on, you sign in with your password plus a six-digit code from an authenticator app such as Google Authenticator or 1Password.
Under Two-factor authentication, click Enable two-factor authentication.
Enter your password in the Confirm your password window and click Confirm.
Scan the QR code with your authenticator app. If you can't scan it, use Can't scan it? Enter this setup key manually and copy the setup key into your app. Then click Continue.
Enter the six-digit code your app shows in Authentication code and click Confirm and enable.
Save your recovery codes somewhere safe, for example in your password manager. Use Copy codes to copy them, then click Done.
The section now shows Enabled. From now on, after your password you're asked for a code from your authenticator app every time you sign in.
Lost your phone? Use a recovery code
You get 8 recovery codes. Each one signs you in once. On the sign-in code screen, click Use a recovery code instead and enter one of your codes in Recovery code.
Once you're in, go back to Security and set up 2FA on your new device. If you're running out of codes, click Show recovery codes and then Regenerate codes. Regenerating replaces all your current codes, so codes you saved before stop working.
If you've lost both your device and your recovery codes, contact your portal admin or ManyRequests support.
Turn 2FA off
Click Disable two-factor authentication and confirm your password. Your password alone will sign you in again.
Log out of other browser sessions
Browser sessions lists where you're signed in: the device and browser, the IP address and when it was last active. Your current one is marked This device.
Click Log out other browser sessions.
Enter your password and click Log out other sessions.
Every other browser and device is signed out. The session you're using stays signed in. If you don't recognize a session, do this and then change your password.
Security emails
You get an email from your portal when something sensitive changes on your account, so you can react if it wasn't you:
someone signs in from a different IP address than your last sign-in
your password is changed, by you or by an administrator
two-factor authentication is turned off
your recovery codes are regenerated
your email address is changed (this one goes to your previous address)
If you get one of these emails and it wasn't you, change your password right away and log out of your other browser sessions.