Signing in and keeping it secure

A password, a second step if you want one, and passkeys for Touch ID or Face ID, which can come first on each device.

Two-step sign-in

Settings → Signing in turns on a second step. After your password, you're asked for a six-digit code from an authenticator app, or you can press Email me a code and have one sent to the address on the account instead.

Turning it on gives you backup codes. Save them somewhere that isn't Scratchpad. They're the way back in if you lose the phone with the authenticator on it, and each one works once.

Passkeys

A passkey signs you in with Touch ID, Face ID, or a security key, with no password typed at all. Add one from the same place, on each device you want to use.

A passkey can also open a locked note with Touch ID or Face ID, instead of you typing that note's password, once you've turned that on for the passkey under Settings → Signing in. Not every passkey can do it, and the page says which of yours can. Each locked note joins the next time you type its password.

Face ID or Touch ID first

Tick Use Face ID first on this device (or Touch ID, on a Mac) under Settings → Signing in, and that device goes straight to Face ID or Touch ID: when you sign in, and when you open a locked note. Cancel it and the password is right there, as usual. It's set per device, so turn it on for your phone and your Mac separately.

Turning it on asks for your account password, then Face ID or Touch ID twice: once to add a passkey kept by the device itself, and once to let it open your locked notes. A passkey kept by a password manager or a security key doesn't count, because those don't use the device's own Face ID or Touch ID.

If Face ID never comes up on an iPhone, check which app keeps your passkeys in iOS Settings → General → AutoFill & Passwords. When a password manager such as Bitwarden is chosen there, it answers instead of Face ID.

If you're locked out

Use Forgot your password on the sign-in page. The link is emailed to the address on the account, and using it signs out every other device, which is what you want if you're resetting because somebody else may be in there. It also ends your API tokens and connected apps, and your passkeys stop signing you in until you keep each one under Settings → Signing in. They still open your locked notes once you're signed in, so a note you only ever open with Face ID is safe.

Changing your password under Settings → Password signs out your other devices, and ends your API tokens and connected apps too.

If you've lost both your password and your authenticator, reset the password by email and take the second-step code by email too, or use a backup code. If you can't read that mailbox either, the account can't be recovered, and that isn't a policy we can make an exception to: your locked notes are encrypted with keys we don't keep.

Last updated 26 September 2026