Security & Two-Factor Authentication

Web: Settings → Security → Account Security. Under Change your password, enter your Current Password, then your New Password and Confirm Password (at least 8 characters), and click Update Password.

Signed up with Google or Apple? The same card shows Add a password as a backup way in instead — enter a Password and Confirm Password (no current password needed) and click Add Password, so email sign-in works too.

Mobile: My Account → Security → Change Password. The app shows a live strength meter and won't accept a weak password, so mix uppercase, lowercase, numbers, and symbols. Mobile always asks for your current password — if you signed up with Google or Apple, add a password on the web first.

WABA's two-factor authentication (2FA) works by emailing you a 6-digit code at sign-in — no authenticator app needed.

Web: Settings → Security → Two-factor authentication. Flip Enable multi-factor authentication on. You can also add an optional Backup Email. It takes effect immediately, and the card then shows "MFA is active".

Mobile: My Account → Security → Two-Factor Authentication. Tapping it turns 2FA on, then asks you to confirm an emailed six-digit code on the Check your email screen before you continue.

Once enabled, signing in on web or mobile asks for an emailed code after your password. On the web, check Remember this device for 30 days on devices you trust to skip the code there.

• Trusted devices — the web tab lists devices you've remembered, active and expired, with Remove Device for any you no longer trust.
• Turning 2FA off — on the web, flip the switch off and confirm your password, then click Disable MFA. On mobile, you verify a fresh emailed code and then your password before tapping Disable 2FA.
• Keep your email account itself secure: with email-based 2FA, your inbox is your second factor.

The web Security tab includes a Security Activity log (click View Activity) so you can review recent events on your account, such as 2FA changes, codes sent, and trusted devices.

On mobile, Sign Out All Devices under Account Security signs you out of every session on every device, including the one you're holding — use it if you think someone else is signed in to your account.