How do I protect my account?

Use Settings > Account to change your password, add an authenticator code to sign-in, or close sessions on other devices.

Change your password

1. Go to Settings > Account.
2. Expand Password, then enter your Current password.
3. Enter your New password, then enter it again in Confirm new password.
4. Leave Sign out other devices selected unless you want to keep those sessions open.
5. Choose Update password.

Your current device stays signed in. If Sign out other devices is selected, ColdMerge closes every other session.

If you forget your password, choose Forgot password on the sign-in page and follow the emailed link. Choose a password different from your current one. A successful reset signs out all existing sessions and emails you a password-change notification. A used reset link says This link was already used; request a new link if you need another reset.

Successful password changes in Settings > Account also email you a security notification. If a Google-only account adds its first ColdMerge password through a reset, the notification says a password was added.

Turn on two-step verification

Two-step verification adds a 6-digit code from an authenticator app after your password.

1. Go to Settings > Account.
2. Under Two-step verification, choose Turn on.
3. Enter your Current password, then choose Continue.
4. Scan the QR code with an authenticator app. If you cannot scan it, enter the displayed key in the app.
5. Enter the 6-digit Code from the app, then choose Turn on.
6. Save the 10 backup codes in a password manager or another safe place.
7. Choose I saved them.

Each backup code can sign you in once. ColdMerge does not show the same codes again.

If you sign in only with Google, this switch is not available. Turn on 2-Step Verification in your Google account instead.

Sign in with two-step verification

1. Enter your email address and password, or select Continue with Google.
2. On Enter your code, enter the current code from your authenticator app.
3. Choose Verify.

Select Don’t ask again on this browser for 30 days only on a device you control.

If you lose your phone, choose Use a backup code instead and enter an unused backup code. After you sign in, choose New backup codes under Two-step verification. Creating new codes makes the old ones stop working.

If you lose both your phone and backup codes, contact support from the email address on your ColdMerge account. There is no self-service recovery path for that situation.

Turn off two-step verification

1. Go to Settings > Account.
2. Under Two-step verification, choose Turn off.
3. Enter your Current password, then choose Turn off.

Your authenticator and backup codes then stop working for this account.

ColdMerge emails your account address when two-step verification finishes setup, is turned off, or its backup codes are replaced. These security notices cannot be turned off in notification preferences and never include your codes or authenticator key.

Recover from an unfamiliar two-step setup

Use the security notice sent when the unfamiliar setup was completed.

1. If you are still signed in, keep that session open. In Settings > Account, sign out other devices and remove the unfamiliar two-step setup. Reset your password, then set up two-step verification again.
2. If you are locked out or Account settings refuses the change, choose Recover my ColdMerge account in the notice before its one-hour link expires.
3. On the recovery page, choose Confirm account recovery. Opening the page alone changes nothing. Confirmation uses the link once, signs out all sessions, and removes the setup associated with that notice.
4. Reset your password, then enroll two-step verification again. Do not rely on backup codes created by the person who enabled the unfamiliar setup.

If Google is linked, also secure your Google Account using the recovery page’s link. Resetting a ColdMerge password does not secure or unlink Google.

Sign out other devices

Use this after leaving ColdMerge signed in on a shared or lost device.

1. Go to Settings > Account.
2. Under Sessions, choose Sign out other devices.
3. Choose Sign out other devices again to confirm.

ColdMerge closes every other session. The device you are using stays signed in.