> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pwnbook.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Set up two-factor authentication, review recent sign-ins, and manage your account's security settings.

## Where to find it

Go to **Profile → Security**. This tab covers account-level security: two-factor authentication, password changes, login activity, and account deletion — separate from [Personal Connections](/profile/connections), which manages your tokens for external integrations.

## Two-factor authentication (MFA)

Pwnbook supports TOTP-based two-factor authentication using any standard authenticator app (1Password, Authy, Google Authenticator, etc.).

To enable MFA:

1. Click **Enable Two-Factor Authentication**.
2. Scan the QR code with your authenticator app.
3. Enter the 6-digit code it generates to confirm enrollment.

Once enabled, you'll be prompted for a code from your authenticator app at sign-in, in addition to your normal login method.

To disable MFA, remove the factor from the same panel. If your organization has a mandatory MFA policy, this option won't be available — talk to your org admin.

<Note>
  Exactly how MFA challenges work depends on how your organization authenticates (local password, magic link, or SSO) — the enrollment step above is the same regardless.
</Note>

## Password

If your account uses password-based sign-in, you can set a new password from the **Password & Authentication** card. This doesn't apply if you sign in via magic link or SSO only.

## Login activity

The **Login Activity** card lists recent sign-ins to your account:

| Field           | Description                                                  |
| --------------- | ------------------------------------------------------------ |
| **Device**      | Browser and OS, parsed from the session's user agent         |
| **Method**      | How you signed in — password, magic link, SSO, passkey, etc. |
| **IP address**  | The IP the session was created from                          |
| **Status**      | `active`, `expired`, or `revoked`                            |
| **This device** | Shown next to the session you're currently using             |

If you spot a session you don't recognize, click the sign-out icon next to it to revoke that session immediately — the device will be signed out on its next request. You can't revoke your current session from this list; use **Sign Out** from the profile menu instead.

<Note>
  Login activity is only available when your organization authenticates via WorkOS (the default for Pwnbook Cloud). Self-hosted deployments using local email/password auth won't see this card populated.
</Note>

## Deleting your account

The **Danger Zone** at the bottom of the page permanently deletes your account: your profile, personal connections, and organization memberships are all removed. This cannot be undone. Content you contributed (task comments, wiki edits, etc.) remains in place, attributed to the deleted account.