Account security

Below Security in Settings, use Profile to update your name. The separate Legal card lets you review the agreements you have accepted.

​

When security is managed at sign-in

If the Security card says your password and two-factor authentication are managed when you sign in, the EveryWealth sign-in screen looks after them for you. Every sign-in asks for your password and a code from your authenticator app, and the password, two-factor and backup code settings described below don’t appear in Settings. To change your password:

1. Select Change password in the Security card. The sign-in screen opens.
2. Select Forgot password? and follow the steps. EveryWealth emails you a link to set a new password.
3. Sign in with your new password.

You can also select Forgot password? on the sign-in screen at any time. If you lose your authenticator app, contact EveryWealth support.

​

Sign-in protection

Verify your email address and set up two-factor authentication before accessing your account’s financial information. Until setup is complete, EveryWealth will guide you back to it. Password sign-in uses your authenticator app, unless you are using an accepted trusted device. If a trusted device is no longer recognised, enter a fresh code from your authenticator app to continue. Passkey sign-in requires your device’s PIN or biometric check. Repeated attempts can temporarily pause sign-in; wait a few minutes before trying again.

​

Forgotten password

1. Select Forgot password? on the sign-in screen and request a reset email.
2. Open the link within one hour and enter a new password of 12–128 characters.
3. If you have two-factor authentication enabled, enter a fresh authenticator code or an unused recovery code.
4. Save the new password, then sign in again.

Resetting your password signs out your existing app sessions and keeps two-factor authentication enabled. It also removes any passkeys on your account, so you can add yours again afterwards. A recovery code used here cannot be used again. If you have lost both your authenticator and your recovery codes, contact EveryWealth support.

​

Change your password

Open your personal Settings and select Change password in the Security section. A centred window opens with three steps across the top. The highlighted step shows where you are, and ticks mark completed steps.

1. Enter your Current password, then select Continue.
2. Enter a New password of 12–128 characters, then enter it again in Confirm new password. Choose a long, unique passphrase that is different from your current password. Select Continue.
3. Enter the six-digit Authenticator code from your authenticator app.
4. Select Change password.

Use the eye button beside a password to Show password or Hide password while checking your entry. Use Back to review an earlier step. Select Cancel or close the window to leave without changing your password; your entries are cleared when you close it. While the change is being saved, wait for it to finish. You must have two-factor authentication enabled. If it is not enabled, select Set up two-factor authentication first. A trusted device still needs a fresh authenticator code to change a password. After the change, the password window closes and a Password changed confirmation opens. Select Done to return to Settings. Your current browser stays signed in and your other sessions are signed out. Use your new password the next time you sign in.

​

Manage two-factor authentication

Complete authenticator setup in one browser tab. If you restart an unfinished setup, use the latest QR code. Once setup is complete, turn two-factor authentication off before setting up a different authenticator. The Security card lists Change password first, followed by Two-factor authentication and Backup codes. Select Manage two-factor to open your two-factor settings. If protection is inactive, select Set up two-factor authentication to connect an authenticator app. If protection is active, enter your Current password and a fresh Authenticator code, then select Disable two-factor. Two-factor authentication is required for your account, so you will need to set it up again to continue using the app after turning it off. A trusted device still needs a fresh code for this change.

​

Add a passkey

A passkey lets you sign in with your device’s PIN, fingerprint or face check. Because a passkey can sign in on its own, adding one needs a fresh code from your authenticator app, just like turning off two-factor authentication. You are offered a passkey as the last step of account security setup.

1. Enter a fresh six-digit Authenticator code. If you have just used a code, wait for your app to show a new one.
2. Select Add passkey, then follow your browser’s prompt.

Each code adds one passkey. If the browser prompt is cancelled or doesn’t work, select Add passkey again: for five minutes after your code is accepted, you can try again without entering a new one. After that, EveryWealth shows That took too long and asks for a new code. If you are asked to sign out and back in first, do so, then add the passkey. EveryWealth emails you whenever a passkey is added to or removed from your account, and signs out connected assistants such as Claude or ChatGPT, which you can reconnect afterwards. If you did not make the change, contact EveryWealth support straight away.

​

Regenerate backup codes

1. Select Regenerate codes beside Backup codes in the Security card.
2. Enter your Current password and a fresh Authenticator code, then select Regenerate codes in the window. Your previous backup codes will stop working.
3. Download, copy or write down the new codes and keep them somewhere private, such as your password manager. These are also called recovery codes; each code can only be used once.
4. Tick I’ve saved my recovery codes somewhere secure, then select Done to close the window.

You need two-factor authentication enabled to regenerate codes. Before generating them, you can select Cancel to leave without replacing your codes. Once the new codes appear, save them before closing; you cannot view that set again later.

​

Password change emails

EveryWealth sends a security email to your account email address after your password changes. It confirms when the change happened and explains what to do if you did not make it. The email never contains your password or authenticator code. If the confirmation email cannot be sent, Settings tells you that your password has still changed. If you receive a password change email for a change you did not make, contact EveryWealth support straight away.

​

New sign-in emails

EveryWealth emails you when a sign-in uses a browser, device type or IP address that differs from your sign-in activity over the past 90 days. The email shows the time, device and IP address, and explains what changed. Signing out does not make EveryWealth forget a familiar device or IP address. Signing in again with a recognised device and IP address, including completing two-factor verification, does not send repeated alerts. Routine browser updates do not count as a new device. A new device or a new IP address can still trigger an alert, even if the other detail is familiar. Once those details have been recorded, further sign-ins with them do not send another alert while they remain in your recent activity. If the sign-in was you, no action is needed. If you do not recognise it, reset your password and contact EveryWealth support straight away.

​

If you cannot change your password

• Check that the new passwords match and that your current password is correct.
• If a code has expired or already been used, wait for a new code in your authenticator app and try again.
• After several attempts, wait five minutes before trying again.
• If you cannot remember your current password, use Forgot password? on the sign-in screen. If you have also lost your authenticator and recovery codes, contact support for help.

​

Blocked account access

If you suspect someone else has access to your account, contact EveryWealth support straight away. Authorised support staff can block sign-ins and revoke existing app sessions. This applies across your organisations and also blocks mobile access and existing connected assistant credentials. While your account is blocked, you can’t sign in, and the sign-in page may say your account access is unavailable or suspended. Contact EveryWealth support to have access restored. If support restores access, you must sign in again and reconnect affected integrations. Previously revoked sessions and credentials remain invalid. Removing someone from one organisation is a separate action and does not block their entire account.