Sign in to your account
No account yet? Create one
Forgot your master password?
It cannot be reset on this page. If you generated a recovery code, open the app and choose Forgot your master password? on its sign-in screen to set a new one. Without a recovery code, your cloud backup cannot be decrypted by anyone, including us.
Account center
Sign-in protection
These settings protect signing in to your OrbitSSH account, on the web and in the app. They are separate from the app lock on your computer.
Authenticator app (TOTP)
Scan the code with Google Authenticator, 1Password, Bitwarden, or any other
compatible app. This is standard TOTP — it is not tied to one app.
- 1Scan the QR code with your authenticator app
- 2Enter the 6-digit code to confirm
- 3Save your one-time backup codes
The QR code is rendered on our own server and never goes through a
third party — drawing it via an external service would mean
handing your 2FA secret to someone else.
Two-factor is only switched on once a code verifies. If you
scanned the wrong code or your phone’s clock is off, it fails now
rather than locking you out at your next sign-in.
Save your backup codes
Write these backup codes down and keep them safe — once you
leave this page they cannot be shown again. The server stores only
their hashes. Each code works exactly once, and they are how you
sign in and turn two-factor off if you lose your phone.
Backup codes
If you lose your phone, each backup code signs you in once. Lost the list, or running low? Generate a new set — the old ones stop working immediately.
Turning it off needs your password again plus a valid code — if being signed in were enough, it would add nothing.
If a YubiKey is registered, remove it first — otherwise the account would be left with a key that has no backup codes.
YubiKey (OTP)
The key acts as a keyboard: put the cursor in the field and touch the
key’s metal contact — it types a long string by itself. This
method does not depend on the domain name, so it works both in the app and
on the web.
Works with the YubiKey 5 series (and NEO / 4). The blue Security Key series has no OTP and cannot be used here.
Turn on the authenticator app above first. It comes with backup codes, so losing a YubiKey can never lock you out of your account.
Sign out of all devices
Ends every signed-in session at once — the app on each computer and this page included. Use it if a device is lost or you signed in somewhere you should not have. Local data on your devices is not deleted; you just need to sign in again.
Device and credential settings remain in the app
Hosts, credentials, terminal settings and team encryption-key operations remain in the app.
Changing your master password can only be done there too — it
also encrypts your cloud backup, so replacing just the login credential on
the server would leave you able to sign in but unable to decrypt your own
data.