We'd like to use analytics cookies to count visits and see where people click, so we can make AltEd better. Nothing you read or type is recorded. Privacy policy
Every way to sign in to AltEd — magic link, password, passkey, or Google/Microsoft/Apple — plus two-factor authentication, resetting a forgotten password and managing your account security in Settings.
What it does
AltEd supports several ways to sign in so you can use whichever suits you:
Magic link (the default) — we email you a one-click link; there's no password at all.
Email & password — the classic, if you prefer it.
Passkeys — sign in with your device's Face ID, Touch ID or screen lock. Fast and phishing-resistant.
Social sign-in — Google, Microsoft or Apple, where the buttons are shown.
You can mix and match: one account can have a password, passkeys and linked social accounts at the same time. On top of a password you can add — a code from an authenticator app on your phone, so a leaked password is not enough on its own. Everything is managed from .
Ready to follow along in the app?
No password, no card — a magic link and you're in.
Account security: /dashboard/settings → the Account & security card
Step by step
Sign in with a magic link
On the sign-in page, make sure the Magic link tab is selected (it is by default).
Enter your Email and click Email me a magic link.
The card confirms the email is on its way. Open the link from your inbox — it signs you in and takes you to your dashboard.
Or type the code. The same email has a six-digit code. Type it under Or type the code from the email and select Sign in with the code — the way to sign in to AltEd added to an iPhone's or iPad's Home Screen (the link opens in Safari, which keeps its own sign-in), or when the email is open on another device. The link and the code last 15 minutes and each works once; three wrong tries and that code stops working — send yourself a new email.
Wrong address? Click Use a different email to go back.
The sign-in page, with the magic link selected
Sign in with a password
Switch to the Password tab.
Enter your Email and Password, then click Sign in. If it's refused, the reason shows in the card, under the password: an account that has only ever used magic links has no password — use Magic link, then add a password in Settings → Account & security if you'd like one.
To create a password account from scratch, click Create an account, fill in Your name, Email and a password, and click Create account. You'll be asked to verify your email address before signing in.
Every password field has an eye button: select it to see what you've typed, and again to hide it. It hides itself again when you submit. A password needs at least 8 characters (and no more than 128) — nothing else is required, so a few ordinary words strung together work well. Wherever you choose a new password, bars under the field show how easy it would be to guess, with a sentence on how to make it stronger. It's advice: only the length decides whether a password is accepted.
Reset a forgotten password
On the Password tab, click Forgot password? (next to the password field).
On the Reset your password card, enter your Email and click Send reset link.
Open the email and follow the link to choose a new password. If you'd rather skip passwords entirely, just use the Magic link tab instead — it always works.
Sign in with a passkey
On a device that supports passkeys, the sign-in card shows a Sign in with a passkey button — click it and approve with Face ID, Touch ID or your screen lock.
Or click into the Email field: many browsers offer your saved passkey in the list of suggestions there. Pick it, approve it, and you go straight on — no button needed.
Don't have a passkey yet? Add one from Settings → Account & security → Passkeys → Add a passkey while signed in, then use it next time.
Turn on two-factor authentication
Two-factor protects a password, so you need one first — use Set a password if you signed up without one.
Go to Settings → Account & security → Two-factor authentication and select Set up.
Confirm your password.
Scan this with your authenticator — or, if you can't scan it, type the key shown into the app by hand — then Enter the 6-digit code it shows.
Save your backup codes. Each works once, only these ten exist, and they are shown only now: they are how you get in if you lose your phone. Select I've saved them.
While two-factor is on, you're asked for your code after an email link, the link that confirms your email address, or a Google, Microsoft or Apple sign-in too, not just after your password — so someone who got into your inbox still can't get into AltEd. A passkey stays one step. To turn it off again, select Turn off, confirm your password, then Confirm it's you with a code from your authenticator app (or a backup code) — a password alone can't take two-factor off, re-key it or show its setup key.
Sign in with two-factor on
Sign in however you like: your Email and Password, the link in your email, or Continue with Google / Microsoft / Apple.
On Enter your code, type the 6-digit code from your authenticator app and select Sign in — you then go on to the page you were heading for. Tick Trust this device only on a device that is yours alone: that device skips the code for 30 days, whichever way you sign in. Changing or resetting your password, Sign out everywhere else, and turning two-factor off or on forget every trusted device — each asks for the code again next time.
No phone to hand? Select I don't have my phone and enter one of your backup codes under Backup code instead.
A passkey signs you in without the code: it is already something only your device has, and it checks it's you — your fingerprint, face or PIN. A security key with no PIN set can't sign you in on its own: set a PIN on it, or sign in another way.
Administrators must use two-factor
AltEd's administration opens only for an administrator who has two-factor turned on and signed in with it — password and code (or a backup code), or a passkey. An administrator without it is sent to Settings → Account & security with a sentence saying why, and can set it up there; everything administrative waits until then. An email link or a Google, Microsoft or Apple sign-in asks for your code like a password does, and once you've entered it administration opens. On a device you've trusted, where the code is skipped, only a password sign-in opens administration — after an email link or Google there, sign out and sign in with your password (and code), or a passkey. Signing an administrator's device out closes administration on it straight away, not after the few minutes ordinary pages can take. Families and providers are not affected: for them two-factor is a choice.
Sign in with Google, Microsoft or Apple
If social sign-in is enabled, the sign-in card shows Continue with Google / Microsoft / Apple buttons — click one and approve in the provider's window.
If an account already exists with the same email but a different method, AltEd asks you to sign in the original way first and then link the provider from Settings — this protects your account from being hijacked by email address alone.
Manage your account security
Go to Settings (/dashboard/settings) and find the Account & security card — "Manage how you sign in to AltEd."
Change email: enter the new address and click Change email; you'll confirm the change from your inbox.
Password: click Set a password (if you signed up without one) or Change password — enter your Current password and a New password. Changing it signs every other device out; this one stays signed in. Setting a first password asks you to confirm it's you first, as adding a passkey does (see below), and we email you once it's added.
Two-factor authentication:Set up or Turn off — see above.
Passkeys: click Add a passkey to register this device; remove any passkey you no longer use. Adding one first asks you to Confirm it's you — see below.
Connected accounts: link a Google, Microsoft or Apple account for one-tap sign-in, or unlink one you no longer want.
Adding a passkey or a first password asks you to confirm it's you
A passkey signs you in in one step — it skips the two-factor code, and changing your password doesn't remove it. So before one is added, AltEd checks it's really you, not just someone at a browser you left signed in:
Two-factor on: enter the 6-digit code from your authenticator app, or select Use a backup code.
A password, no two-factor: enter your password.
Neither (you sign in with an email link or Google, Microsoft or Apple): select Sign in again. You come straight back to Settings → Account & security to add the passkey — if you signed in within the last ten minutes, you're not asked at all.
Once you've confirmed, you can add passkeys for ten minutes without being asked again. After five wrong codes or passwords you're asked to sign in again before you can try more. Removing a passkey never asks.
Every time a passkey is added, we email you to say so — with its name and when. If it wasn't you, remove it under Passkeys and change your password.
Setting a first password (on an account that signs in by email link or Google, Microsoft or Apple) is a new way in too, so it asks the same: usually Sign in again, unless you signed in within the last ten minutes. We email you once a password has been added. If you didn't add it, use Forgot password? on the sign-in page to reset it — that signs every other device out.
Where you're signed in
Settings → Account & security lists every device with a live session, showing the browser and operating system, roughly when it signed in, and its IP address. The one you're using is marked this device.
Sign out on any other row ends that device's session.
Sign out everywhere else ends all of them at once and leaves you signed in here. It also forgets every device you'd trusted to skip the two-factor code.
How quickly it takes effect. Sessions are cached for a few minutes so that every page load doesn't need a database lookup, so a device that's actively in use can keep working for up to five minutes after you sign it out. That's fine for tidying up an old phone. If a device has been lost or stolen, change your password as well — that ends every session at once, everywhere, immediately.
Tips
Magic links, their codes and reset links are single-use and expire — if one has gone stale, just request a fresh one.
Passkeys are per-device (or synced by your platform, e.g. iCloud Keychain). Adding one on your laptop doesn't remove any other way of signing in.
Keeping at least two sign-in methods (say, magic link plus a passkey) means you're never locked out.
Keep your two-factor backup codes somewhere other than your phone — a password manager or a printed copy. They are the way back in if the phone is lost, and they can't be shown again.