The Security tab in Settings holds the account security controls: password change, two-factor authentication, passkeys, active sessions, browser extension sessions, privacy controls, and account deletion. This page describes each section in the order it appears on the tab and links to the full guide for each feature.
A signed-in AliasFleet account is required. All seven sections are on the same page, and no separate page or tool is needed for any of the controls listed here.
How do I open the Security tab?#
The Security tab is part of the Settings page. The sections below appear in the same order as on the tab.
- Open Settings: sign in, then open Settings from the dashboard.
- Select Security: click Security in the Settings tab list.
- Use the direct link: the tab also opens at
/settings?tab=security.
What is on the Security tab?#
The tab holds seven sections: Password, Two-Factor Authentication, Passkeys and Security Keys, Active Sessions, Browser Extensions, Privacy Controls, and Delete Account, in that order. Each section below states what the control does and links to the full guide where one exists.
Password#
The Password section changes the account password. The Change Password button opens a dialog with three fields: Current Password, New Password, and Confirm New Password. The current password is checked before the change is accepted. See Changing your password.
Two-Factor Authentication#
Two-factor authentication adds a verification code step to sign-in, in addition to the password. Three methods are offered: Authenticator App (TOTP), Email OTP, and Passkey / Security Key. When two-factor authentication is off, the section shows a Recommended badge; when it is on, it shows an Active badge with the method in use and a count of 10 recovery codes. Each recovery code works once, for use if the authenticator device is lost. See Two-factor authentication.
The Email OTP code goes to the account email. Where the account email is itself an alias, the code arrives through forwarding like any other message. See Can You Receive Two-Factor Authentication Codes at an Email Alias?.
Passkeys and Security Keys#
The Passkeys and Security Keys section lists the passkeys registered on the account and adds new ones. The Add Passkey button starts registration, and each passkey is named before it is saved. A passkey is shown as either a Synced Passkey or a Hardware Key, and can be renamed or removed from the list. A registered passkey works in two ways: as a two-factor authentication method, and as a passwordless sign-in at the login page.
Active Sessions#
The Active Sessions section lists every device signed in to the web account. A count badge shows the number of active sessions, and the View Sessions button opens the full list. Each session shows the browser, operating system, location, and last active time, with the current session marked. A session can be terminated from the list, and the current session can be trusted for 30 days, during which two-factor authentication is not requested on it again. Terminating the current session signs the account out and returns to the sign-in page. See Active sessions.
Browser Extensions#
The Browser Extensions section lists the browser extension sessions, which are separate from the web account sessions. A count badge shows the number of connected extensions, and an Installed or Not installed badge shows whether the extension is present in the current browser. When the extension is not installed, the Get Extension button opens the browser store page. The Manage Sessions button opens the extension session list, where a single session can be revoked or all extension sessions can be revoked at once. See Browser extensions.
Privacy Controls#
The Manage Privacy Controls button opens a dialog titled Privacy Controls. The dialog manages how AliasFleet logs, parses, and retains email metadata and telemetry.
Delete Account#
The Delete Account section is at the bottom of the tab. The Delete Account button opens a confirmation dialog that lists what deletion removes. Confirmation is by typing the exact username shown in the dialog, not by entering a password. Deletion is permanent, with no recovery after it. See Deleting your account.
How do I revoke a session from the Security tab?#
Sessions are revoked from the lists opened on the tab, not from the tab itself.
- Open the session list: click View Sessions for web sessions, or Manage Sessions in the Browser Extensions section for extension sessions.
- Find the session: check the browser, operating system, location, and last active time against the device in question.
- Revoke it: terminate the single session, or use the revoke-all option in the extension session list to end every extension session at once.
- Check the list again: the revoked session no longer appears in the list.
How do I check that a change worked?#
Each control on the tab gives its own confirmation. A password change shows a success message stating the password has been changed. Turning on two-factor authentication changes the section to the Active badge, with the method and the recovery code count. A revoked session no longer appears in the session list. An added passkey appears in the passkey list with the name given during registration.
What if something on the tab does not load?#
If the session list fails to load, the Active Sessions section shows the message "Failed to load - check sessions for details". The View Sessions button still opens the list, where the error is shown again. The Browser Extensions section behaves the same way, showing "Failed to load - check extensions for details" when the extension list cannot be loaded. If either message appears, reload the page and try again. If the message stays, it may indicate a connection or server problem rather than a setting on the tab, and the lists cannot be managed until loading works.
An unrecognised device or location on the session list should be revoked first, then the password changed from the Password section. If two-factor authentication is off, it should be turned on from the Two-Factor Authentication section after the password change.