Skip to content
React Box

Your account

Security

Password, two-factor authentication, linked accounts, connected devices: everything that protects access to your accounting data.

Updated on August 14, 2026

The password

You can change it at any time from the Security tab, by entering the current one then the new one. An option lets you sign out all your other devices in the same move — the right reflex when you are changing the password because you think it leaked.

Note

Signed up through Google, Apple or Microsoft? You have no password. You can set one to also sign in by email, without losing the social connection.

Two-factor authentication

A second proof of identity, on top of the password.

  1. 1

    Confirm your password

    React Box then generates the secret key specific to your account.

  2. 2

    Scan the QR code

    With the authenticator app of your choice — Google Authenticator, 1Password, Authy — or by entering the key by hand.

  3. 3

    Keep your backup codes

    They let you sign in if you lose your phone. Each works once: store them somewhere other than that phone.

  4. 4

    Confirm with a six-digit code

    Activation only takes effect once that code is verified. A code will then be asked for at every sign-in.

Note

Turning it off asks for your password again. That is deliberate: nobody should be able to weaken your account from a session left open.

Linked accounts

Google, Apple and Microsoft can serve as sign-in methods, alongside or instead of a password. You can link and unlink them freely, on one condition: keeping at least one way to sign in. If a social account is your only method, set a password before unlinking it.

Note

Linking a social account gives that provider no access to your data: it only proves who you are at sign-in time.

Devices and sessions

The list of connected devices shows, for each one, the sign-in date and the address it came from. The current device is flagged. You can sign out a single device, or all the others at once — access stops immediately, without waiting for the session to expire on its own.

Warning

A device you do not recognise? Sign it out, then change your password straight after.

On mobile

The mobile app adds a device-level protection of its own: a fingerprint or face lock, off by default, with a re-lock delay you choose. It complements the password rather than replacing it — it protects the open app, not the account itself. The detail sits in the section devoted to the mobile app.