Skip to main content

​
Where to find it

Go to Profile → Security. This tab covers account-level security: two-factor authentication, password changes, login activity, and account deletion — separate from Personal Connections, which manages your tokens for external integrations.

​
Two-factor authentication (MFA)

Pwnbook supports TOTP-based two-factor authentication using any standard authenticator app (1Password, Authy, Google Authenticator, etc.). To enable MFA:
  1. Click Enable Two-Factor Authentication.
  2. Scan the QR code with your authenticator app.
  3. Enter the 6-digit code it generates to confirm enrollment.
Once enabled, you’ll be prompted for a code from your authenticator app at sign-in, in addition to your normal login method. To disable MFA, remove the factor from the same panel. If your organization has a mandatory MFA policy, this option won’t be available — talk to your org admin.
Exactly how MFA challenges work depends on how your organization authenticates (local password, magic link, or SSO) — the enrollment step above is the same regardless.

​
Password

If your account uses password-based sign-in, you can set a new password from the Password & Authentication card. This doesn’t apply if you sign in via magic link or SSO only.

​
Login activity

The Login Activity card lists recent sign-ins to your account: If you spot a session you don’t recognize, click the sign-out icon next to it to revoke that session immediately — the device will be signed out on its next request. You can’t revoke your current session from this list; use Sign Out from the profile menu instead.
Login activity is only available when your organization authenticates via WorkOS (the default for Pwnbook Cloud). Self-hosted deployments using local email/password auth won’t see this card populated.

​
Deleting your account

The Danger Zone at the bottom of the page permanently deletes your account: your profile, personal connections, and organization memberships are all removed. This cannot be undone. Content you contributed (task comments, wiki edits, etc.) remains in place, attributed to the deleted account.