Security
Keep your account safe with password and sign-in settings.
The Security page lets you change your password. To get here, go to Account Management from the Profile Menu and select the Security tab.
Changing your password
Changing your password is a two-step process: first you verify your identity with your current password, then you set a new one.
Verify your current password
Enter your current password in the field provided and click Validate Password. A spinner will appear while Aura checks your credentials. If the password is correct, you'll move on to the next step. If it's wrong, you'll see an error message with a Try Again button.
Set your new password
Once validated, two new fields appear:
- New Password - type your new password here. As you type, a helper message below the field tells you the requirements.
- Confirm Password - re-enter the same password. If the two don't match, you'll see a "Passwords do not match" error.
The Update button stays disabled until your new password meets all requirements and both fields match.
Confirmation and sign-out
After a successful password change, you'll see a green checkmark and a "Password Updated!" message. A countdown timer appears (starting from 5 seconds) and you'll be automatically signed out so you can sign back in with your new password.
Password requirements
Your new password must meet all of the following:
- At least 8 characters long
- Contains at least one uppercase letter (A-Z)
- Contains at least one lowercase letter (a-z)
- Contains at least one number (0-9)
- Contains at least one special character (like !, @, #, $, %, ^, &, *)
Use a strong, unique password that you don't use on other sites. After changing your password, you'll be signed out automatically and need to sign back in.
What else happens behind the scenes
A few security safeguards run automatically and aren't shown as toggles on this page:
- All other sessions are signed out. Whether you change your password from this page or reset it via a "forgot password" email, every other active session on your account is signed out immediately - only the device you just used stays signed in (and even that one ends if the change came from the security page's own flow).
- New sign-ins are watched. If Aura sees a sign-in from a browser, device, or IP address it hasn't seen before - or a sign-in from an unusual location shortly after one somewhere else - it sends you an email alert so you can confirm it was really you.
Aura doesn't currently show a list of your active sessions or devices in the app, so you can't view or revoke individual sessions from the UI. If you suspect unauthorized access, changing your password will sign out every other session at once.
Connected sign-in providers
If you signed up using Google or Microsoft, your account is linked to that provider. You can always sign in using that provider's button on the sign-in page. If your account was created with a social provider, you won't have a password to change - your authentication is handled entirely by that provider.
Last updated on