Account security

Changing your password

While signed in, open Account Settings → Security. Enter your current password and a new password of at least 10 characters. A successful change keeps the session you are using and signs out your other sessions.

Two-factor authentication

On the Security tab, choose Set up authenticator, confirm your password, then scan the QR code with an authenticator app. Enter its current 6-digit code to finish. Save the ten one-time recovery codes somewhere secure: each can replace an authenticator code once if you lose access to the app. The codes and setup secret are cleared when you close Account Settings or leave Security; they cannot be retrieved again. Two-factor authentication protects password, Google, and GitHub sign-ins.

Recovering from a lost authenticator

Already signed in? On the Security tab, disable two-factor authentication with your current password and an unused recovery code, then enroll your replacement app. Signed out? Complete your password or Google/GitHub sign-in, then choose Lost your authenticator? on the verification screen. Enter your QueryBolt password and one unused recovery code to turn off two-factor authentication, invalidate the remaining codes, and sign out existing sessions. This works with your last code: do not first spend it using Verify and sign in. Sign in again and set up the replacement app. A security notice is sent to your account email when two-factor authentication is turned off.

If you have no recovery codes

If your authenticator still works, use its current code and your password to disable two-factor authentication and enroll again to get new recovery codes. If you have lost both, contact support from your registered email. Simply emailing support is not proof of ownership: support sends a fresh, single-use confirmation link to your existing primary email and separately checks recent account-specific billing evidence. Never share passwords, authenticator codes, recovery codes, full card numbers, or verification links with support. Confirmation does not itself remove MFA. After approval, existing sessions and recovery codes are invalidated and a security notice is sent; sign in again and enroll your replacement authenticator. Accounts without their own billing evidence, including free accounts and team members, require escalation; recovery is not guaranteed. A password-reset email alone never removes MFA.

Accounts created with Google or GitHub

If you created the account through Google or GitHub and have never set a QueryBolt password, use Forgot password on the sign-in page first. The reset link establishes a password for direct sign-in and sensitive account changes.

Changing your email address

Enter the new address and your current password in the same Account Security card. QueryBolt sends a one-time link to the new mailbox. Your existing email remains your login until that link is verified, and the old address receives a security notice after the change completes.

Verification and sessions

Email-change links expire after 24 hours and can only be used once. Completing a change signs out other sessions; if you verify in the session that requested it, that current session stays active with the new email.

Reviewing account activity

The same Account Security card lists your active QueryBolt sessions and successful sign-ins from the last 30 days, including the browser, device type, IP address, and time available to QueryBolt. Sign-ins are shown 10 at a time; use Previous and Next when there are more in that window. Older sessions may show limited device details.

Ending sessions

Use Log out beside an individual session you do not recognize, or Log out other sessions to end every session except the browser you are currently using. If any login looks unfamiliar, end the other sessions and change your password.