Authentication & sign-in
Atlas protects sensitive family information. Choose strong sign-in methods and keep recovery options ready.
Our recommendation
Best: use a passkey (Face ID, Touch ID, Windows Hello, or a security key). Passkeys are phishing-resistant and usually don’t need a separate authenticator code.
Minimum: password + authenticator app (TOTP). If you sign in with a password, Atlas will ask for a 6-digit code from your authenticator after the password is accepted.
Sign-in methods at a glance
- Passkey — preferred. Uses your device biometric or PIN. No password to type; no authenticator code after a successful passkey sign-in.
- Password — at least 12 characters. Alone is weaker; pair it with an authenticator app.
- Authenticator app (TOTP) — apps like Google Authenticator, Authy, or 1Password. Required after password when enabled.
- Recovery codes — one-time backup codes if you lose your authenticator. Store them offline.
What happens when you sign in
- Passkey: choose “Sign in with passkey,” confirm with Face ID / Touch ID / Windows Hello, and you’re in — no 2FA prompt.
- Password with authenticator enabled: enter email and password, then enter the 6-digit code (or a recovery code).
- Password without authenticator: email and password only. We strongly recommend enabling an authenticator as soon as you can.
How to set this up
- Sign in, open Security settings.
- Under Authenticator app, set up TOTP and save the recovery codes when they’re shown (they appear only once).
- Under Passkeys, add at least one passkey — ideally two, on different devices — so you aren’t locked out if you lose a phone.
Good habits for families
- Each person should have their own Atlas account — never share passwords or passkeys.
- Prefer passkeys for day-to-day sign-in.
- Keep password + authenticator as a reliable backup path.
- Print or download recovery codes and store them somewhere safe offline.
- Review signed-in devices in Security and revoke anything you don’t recognize.
Need to reset a password?
Use Forgot password on the sign-in page. You’ll get a short-lived email link. After a successful reset, all sessions are signed out and you’ll need to sign in again.
