# Account security: getting in, taking everything, leaving.

Source: https://www.onsecondbrain.com/guide/account-security  
Language: en  
Spanish version: https://www.onsecondbrain.com/guide/account-security.es.md

---

The Security tab of your account settings brings together two-step verification, exporting all your data and deleting the account: this page explains how each one is set up and what exactly happens when you use it. At the very top there is also Analytics cookies, to accept or reject Google Analytics; the app works the same either way.

## Signing in

### Two-step verification

A code from your authenticator app on top of your password. If someone steals your password, it is not enough to get in.

1. **Open the tab** — The circle with your initials, top right → Account settings → Security, and hit Turn on under two-step verification.
2. **Scan the code** — With whichever authenticator app you use — the three most common ones are walked through below. If you cannot scan, open Can't scan? Type the key in manually, under the QR, and copy the key.
3. **Confirm with the code** — Type the six digits your app is showing at that moment and hit Turn on. Only then is it active.
4. **Save the recovery codes** — They are shown once, right after you enable it. Copy them into your password manager or onto paper — anywhere except the same phone that holds the authenticator app.

Which app?:

**Apple Passwords**

Already on your iPhone, iPad and Mac, and it fills the code in for you when you sign in.

1. **Open Passwords** — The Passwords app on your iPhone, iPad or Mac, and open the secondbrain password you already saved.
2. **Set Up Verification Code** — Tap it and pick Scan QR Code. If the QR is on that same screen, use Enter Setup Key and paste the key.
3. **Done** — The six-digit code lives inside that entry and autofills when you sign in.

**Google Authenticator**

The most common one, free on Android and iPhone.

1. **Tap the +** — Bottom right of the app main screen.
2. **Scan a QR code** — Point the phone at the QR on screen. If the QR is on that same phone, use Enter a setup key and paste the key.
3. **Done** — "secondbrain" shows up in the list, with a code that rolls every 30 seconds.

Turn the cloud backup on if you want it back when you change phones.

**Microsoft Authenticator**

Same idea, and if you already use it for work everything stays in one place.

1. **Tap the +** — Top right: Add account.
2. **Pick "Other account"** — The standard-code option — the one that says Google, Facebook, etc. — not personal account and not work account.
3. **Scan the QR** — Or Enter code manually and paste the key.

With the backup turned on, you get it back when you change phones.

Any app that makes six-digit codes works: 1Password, Authy, Bitwarden or whatever you already have.

From then on, every sign-in asks for the code as well as the password. The tab shows how many unused recovery codes you have left, and from there you can generate new ones — which void the previous set — or turn verification off.

> **If you lose your phone**
>
> Each recovery code gets you in once, and is then spent. That is why where you saved them matters: if they live on the same phone as the authenticator app, they are worth nothing on the day you need them.
>
> Once you are back in with a code, the first move is to generate new codes and set verification up again on the new phone.

## Taking it all, or leaving

### Export all your data

Under Export all my data, the Download ZIP button builds it on the spot and downloads it. No emailing support, no waiting for approval.

Inside there is one folder per workspace, with:

- Your documents in Markdown, which is the format that will still be readable anywhere.
- The data in JSON: daily notes, tasks, meetings and their action items, Atlas entities and their links, canvases, definitions, deliverables and the digests generated.
- The files inside the ZIP, not as links: up to 150 MB per workspace. Whatever does not fit is still listed, with a download link that lasts seven days — the limit is disclosed, not hidden.
- A summary of what was included and what was left out.

Integration tokens and secrets never leave in the export.

### Delete the account

It sits last in the tab — on the phone, More → Settings → Delete account — and runs through three screens: what gets deleted, why you are leaving and the confirmation, where you type ELIMINAR and, if you sign in with a password, your password.

On confirm it wipes, permanently and with no grace period: your account and profile, your daily notes, documents and tasks, your meetings and their recordings, your workspaces and the files you uploaded.

If you paid for your subscription on the web or the computer, it cancels itself. If you bought it on the iPhone, Apple bills it and deleting the account does not stop it: cancel it in your Apple ID subscriptions.

Download the export ZIP before you confirm: afterwards there is nothing left to ask us for.