Security settings
Manage how you unlock Atlas on this device and across your signed-in sessions.
Start here
Open Security settings after you sign in. Sensitive changes may ask you to confirm with a passkey, authenticator code, or recovery code.
Passkeys
Passkeys use Face ID, Touch ID, Windows Hello, or a hardware security key. They’re the fastest and safest day-to-day sign-in.
- Add at least one passkey; two on different devices is better.
- Give each passkey a clear name (for example “iPhone” or “Laptop”).
- Remove passkeys you no longer use.
Passkeys & multiple devices
A passkey lives where you create it. To use the same passkey on your phone and laptop, save it in a cross-device password manager (iCloud Keychain, Google Password Manager, 1Password, Bitwarden, etc.) or a browser profile that syncs across devices (e.g. Chrome signed into the same Google account).
When your device asks where to save the passkey, choose a syncing provider — not "This device only." Otherwise, create a separate passkey on each device, or keep password + authenticator as a fallback.
Authenticator app (TOTP)
Pair an app such as Google Authenticator, Authy, or 1Password. When you sign in with a password, Atlas asks for a 6-digit code.
- Scan the QR code (or enter the setup key) in your authenticator.
- Confirm with a code to finish enabling.
- Save the recovery codes when they’re shown — they appear only once.
Recovery codes
- One-time backup codes if you lose your authenticator.
- Download or print them and store them offline.
- You can regenerate a new set (this invalidates the old ones) after re-authenticating.
Quick unlock
Optional 6-digit PIN (and Face ID when a passkey is available) so you don’t fully sign out after a short break.
- After about 2 hours idle, Atlas soft-locks and asks for PIN or Face ID.
- Quick unlock stays available for roughly a week after a full sign-in; after that you’ll sign in normally again.
- You can enable it on this device or disable it everywhere.
Devices and push
- Review signed-in sessions, rename devices you recognize, and revoke any you don’t.
- “Sign out all” ends every session — useful if a device is lost.
- Browser push notifications (for reminders in the background) can be enabled here when supported on your device.
Also see
For sign-in recommendations and recovery habits, read Authentication & sign-in.