Secure your BitQate account

Anyone who gets into your BitQate account can open consoles, read files, restore backups and spend your balance. These settings take a few minutes and make that far harder. All of them are under Settings.

1. Use a strong, unique password

Go to Settings → Security → Password. Passwords need at least 8 characters with an uppercase letter, a lowercase letter, a number and a symbol, but longer is better. Use a password manager and don't reuse a password from another site.

Changing your password sends a Password Changed security alert to your email.

2. Turn on two-factor authentication

With two-factor authentication (2FA), signing in also needs a 6-digit code from an app on your phone, so a leaked password alone isn't enough.

1. Go to Settings → Security and click Enable 2FA.
2. Click Start Setup.
3. Scan the QR code with an authenticator app such as Google Authenticator, Authy, 1Password or Bitwarden. If you can't scan it, type the code shown under Or manually enter this code.
4. Enter the 6-digit code from the app and click Enable 2FA.

From then on, every sign-in asks for a code. To turn 2FA off later, enter a current code and click Disable 2FA. Both changes send a security alert to your email.

Keep access to your authenticator. If you replace your phone, move the 2FA entry to the new one before wiping the old one. Most authenticator apps can export or sync their entries. If you lose access entirely, email support@bitqate.com from your account's email address.

3. Add a passkey

A passkey lets you sign in with your fingerprint, face, device PIN or a hardware security key instead of typing a password. It's tied to BitQate's address, so it can't be phished by a lookalike site.

1. Go to Settings → Security → Passkeys.
2. Click Add passkey for this device and follow your browser's prompt.
3. Optionally Rename it (for example "Work laptop" or "YubiKey") so you can tell your passkeys apart.

Add one on each device you sign in from. If you lose a device, Remove its passkey here.

4. Review trusted login locations

Settings → Security → Trusted Login Locations lists the IP addresses you've signed in from. Signing in from an address that isn't on the list requires a verification code sent to your email, unless 2FA is on (then your authenticator code is used instead). An address stops counting as trusted after 90 days without use.

• Revoke any address you don't recognise.
• If you think someone else has signed in, Revoke all, change your password and turn on 2FA.

5. Choose when you're signed out

Under Settings → General → Session, Sign out after inactivity sets how long you stay signed in without using the dashboard, from 30 minutes to 30 days. It applies to all your signed-in devices. Pick a short value if you use shared or public computers.

6. Keep security alerts on

Under Settings → Notifications, leave Security Alerts enabled. BitQate emails you when your account is accessed from a new location, when your password changes, and when 2FA is turned on or off. If you get an alert you don't expect, change your password right away and review your trusted locations.

Workspaces

If you share servers with others through a workspace, each member signs in with their own account and their own 2FA. Give people only the access they need; see Share servers with a workspace.