Account & Security

This guide covers the two things that keep your account yours: how you sign in, and two-factor authentication (2FA), a second step after you sign in.

Before you start

Where: from inside your workspace, click Security in the sidebar. This is where you manage your sign-in methods and two-factor authentication.
Who: anyone with a DS160.io account, in a personal or a business workspace. Each person manages their own sign-in.
For two-factor authentication: an authenticator app on your phone, such as Google Authenticator, Authy or 1Password.

Under How you sign in you see your sign-in email, your password and Google, one row each. Your account can have a password, a Google account, or both, and you can sign in with either.

Add Google to a password account. Under How you sign in, click the Google button and choose your Google account. If you simply choose Continue with Google on the sign-in page with the same email address, it is added for you. Either way, we email you to say Google was added.
Add a password to a Google account. Click Set a password. We email you a link; open it and choose your password.
Change your password. Click Change password and enter your current password and the new one. Every other device you were signed in on is signed out.
Disconnect Google. Click Disconnect. Your account needs a way in, so you can only disconnect Google once the account has a password. Before it disconnects, we warn you: once Google is disconnected, choosing Google with that address on the sign-in page would start a new, empty account.

Signed up with a password but never confirmed your email, then signed in with Google? Google proves the address is yours, so we remove the unconfirmed password and sign out every device, in case someone else set it. You can set a new password at any time.

Example: how this looks on the platform

Forgot your password?

On the Log in page, click Forgot password?, or go straight to Reset your password.
Enter your email and we send you a link to choose a new password. The link works once, for one hour.
Open the link and choose your new password.

Setting a password this way signs you out everywhere else, and two-factor authentication still applies the next time you sign in.

In the Email row, click Change email. It asks one thing at a time:

The new address. Type it and click Continue. If a Google account is connected and its address differs from your sign-in email, you can click that address instead.
Confirm it is you. If your account has a password, enter it. If not, click Email me a code and enter the 6-digit code we send to your current address; it works for 10 minutes. Use another way lists the other ways your account has: your password, Google, or the code. With two-factor authentication on, you also enter a code from your authenticator app here. Then click Send confirmation link.
Open the link. We email a link to the new address. Your email changes only when you open it and click Confirm my new email, within 24 hours. Until then you keep signing in with your current address, and the Security page shows the change waiting, on any device, with Resend link and Cancel change.

When you confirm, every device is signed out, and the sign-in page starts with your new address filled in. Your password, Google sign-in and two-factor authentication stay as they were, and we email both the old and the new address to say it changed.

If you chose your Google account’s address, Google has already verified it, so the change happens as soon as you sign in with Google, with no link. Your other devices are signed out; this one stays signed in.

Moving away from a Gmail address? Signing in with Google keeps working after the change. To stop using it, click Set a password if your account has no password yet, then Disconnect on the Google row.

If the new address already has a DS160.io account, nothing changes, and we tell that address someone tried to use it. A workspace owner cannot change a member’s email: the member changes it here, or writes to us.

Two-factor authentication

With 2FA on, after you sign in you enter a short code from an authenticator app on your phone. Even if someone learns your password, or gets into your Google account, they can’t get in without that code. It applies whether you sign in with a password or with Google.

Enable two-factor authentication

Enrollment is a short wizard:

Scan the QR code. Open your authenticator app (Google Authenticator, Authy, 1Password, etc.) and scan the QR code shown on screen. Can’t scan? Enter the setup key shown beneath the code manually instead.
Verify a code. Your app now shows a 6-digit code that rotates every 30 seconds. Type the current code to confirm the link worked.
Save your recovery codes. We show a one-time list of single-use recovery codes. Copy or download them and store them somewhere safe — they are the only way back into your account if you ever lose your phone.

Once you confirm, 2FA is active. The next time you sign in, you’ll be asked for a code after your password or your Google sign-in.

Scan this QR code with your authenticator app — Example: how this looks on the platform

Recovery codes

Recovery codes are your backup. Each code works once. If you can’t reach your authenticator app, choose the recovery-code option at sign-in and enter one of them.

Keep them somewhere separate from your phone — a password manager or a printed copy in a safe place. If you run low or think they’ve been exposed, disable and re-enable 2FA to generate a fresh set.

Example: how this looks on the platform

Disable two-factor authentication

On the Security page, choose Disable. For your protection, this requires your current password and a valid 2FA code (or a recovery code). If your account has no password, you confirm with the Google account you sign in with instead. Once disabled, sign-in no longer asks for a code and your old recovery codes stop working.

Expected result

The Security page shows how you sign in: your email, your password and Google, one row each. With two-factor authentication on, every sign-in asks for a code from your authenticator app after your password or Google, and your recovery codes are stored somewhere safe.

Troubleshooting

Problem	What to do
“This password reset link has expired or has already been used.”	The link works once, for one hour. Click Forgot password? on the Log in page to get a new one.
“This account signs in with Google.”	The account has no password. Sign in with Google, or use Forgot password? to add one.
“Invalid verification code” when you sign in	Type the code your app shows now: it changes every 30 seconds, and each code works once. Lost your phone? Enter one of your recovery codes instead.
“Invalid or expired MFA challenge”	The code screen was open too long. Sign in again and enter a fresh code.
You lost the phone with your authenticator app	Choose the recovery-code option at sign-in and enter a recovery code. Then disable and re-enable 2FA with your new phone to get a fresh set of codes.
“Your current password is not correct.”	Under Change password, enter the password you sign in with now. Forgot it? Use Forgot password? on the Log in page.
“Google is this account’s only way to sign in.”	Click Set a password and choose one from the link we email you, then click Disconnect.
“This Google account is already connected to another DS160.io account.”	Sign in to that account with Google instead, or connect a different Google account.
“This link has expired or has already been used.” after changing your email	The link to the new address works once, within 24 hours. Ask for a new one from the Security page.
“Another DS160.io account now uses this address, so your email was not changed.”	Choose a different address, or sign in to the account that already uses this one.

Next steps

New here? Start with Account & Workspace Basics.
Ready to file? See Getting a Successful Submission.