Type your email address and we send one email with a six-digit code and a sign-in link. Enter the code on the device you are using, or open the link on any device to sign in there; the link’s page says who is signing in and from which browser, and signs in only when you press Continue. Each code and link works once, for 10 minutes, and using one retires the other.
Creating an account works the same way: your email address, then the code or link, then your name and username, so every new account’s address is confirmed from the start. Joining from an invitation does too. Two-step sign-in still asks for your authenticator code or passkey after the email step, and passkeys, Google, phone numbers, single sign-on and signing in with a QR code are unchanged.
Nothing asks for a password any more. Confirming it is you before deleting your account, downloading your data, changing your email address or turning two-step sign-in off takes a passkey, an authenticator code or a code we email you; with two-step sign-in on, the emailed code is not enough. Signing in with a password, and resetting or changing one, are retired, and scripts that signed in with a password should use an app token. In Kemble Desktop the code works as before, and a link opens your browser.