Security

Two-factor authentication asks for a temporary code from an authenticator app after you enter your password. Knowing your password alone is no longer enough to access your account.

1. Open Settings, then Security.
2. Select Setup two-factor authentication.
3. Scan the QR code with your authenticator app, or copy the setup key into the app.
4. Enter the code from the app to finish setup.
5. Save the recovery codes somewhere safe. Each code can help you get back in if you lose your device.

A password manager is a good place for the setup key and recovery codes. Do not keep your only copy on the same phone as your authenticator app.

A passkey lets you sign in using Touch ID, Face ID, your device PIN, or a physical security key. Passkeys are resistant to phishing because they only work for the Cirrux website they were created for.

1. Open Settings, then Security.
2. Select Register new passkey.
3. Follow the prompt from your device, password manager, or security key.
4. After registration, open the passkey menu and rename it so you know which device it belongs to.

You can register more than one passkey. After you have successfully signed in with one, you can also require passkeys for login and disable password login. Keep a second passkey in a safe place before doing this so a lost device does not lock you out.

Use a long password that you do not use for any other service. A password manager can generate and store it for you. If another service is breached, a unique password keeps that breach from becoming access to your Cirrux account.

The Security page lists signed-in devices and apps you have authorized. Revoke anything you do not recognize or no longer use. Keep your devices and browser up to date, and protect every device with a screen lock.

Cirrux support will never ask you to send us your password, two-factor code, recovery code, passkey, or app password. Never share these by email, chat, or phone. Only enter your Cirrux password on mail.cirrux.pro or in the Cirrux app when it asks you to confirm a sensitive action.

Be cautious with unexpected links and attachments, even when a message looks urgent. If you are unsure, open Cirrux yourself instead of using the link in the message. Forward suspicious messages claiming to be from Cirrux to help@cirrux.pro.