> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qtap.qa/llms.txt
> Use this file to discover all available pages before exploring further.
# Security
> Change your password, set up two-factor authentication, and manage active sessions.
The Security page handles password changes and two-factor authentication setup. There's also a sessions panel if you need to sign out everywhere at once. Go to **Settings → Security** to get there.
Only account owners can reach this page by default. Managers and staff can access it if their account has the settings permission turned on. You can change that under **Staff → \[staff member] → Permissions**.
## Change your password
Type your existing password in the **Current Password** field. Qtap verifies it before making any changes. If you type it wrong, you'll see a "Current password is incorrect" error and the new password won't be saved.
Type your new password in **New Password**, then repeat it in **Confirm New Password**. The new password must be at least 8 characters.
Click **Update Password**. A green confirmation message appears for a few seconds, then the three fields clear.
If you need to reset a forgotten password instead of changing it, use the forgot password link on the login page. The form on this page requires your current password.
## Two-factor authentication
Two-factor authentication (2FA) means that after you enter your password, you also need a 6-digit code from an authenticator app on your phone. Even if someone gets hold of your password, they still can't log in without your phone.
Qtap uses TOTP (time-based one-time passwords). Any standard authenticator app works: Google Authenticator, Authy, Microsoft Authenticator, or 1Password's built-in authenticator.
### Setting it up
On the Security page, find the **Two-Factor Authentication** section. The badge next to Authenticator App shows **Not Enabled**. Click **Enable**. A dialog opens with a QR code.
Open your authenticator app and scan the QR code. If your app doesn't support scanning, use the manual entry key shown below the QR code — copy it into your app's "add account manually" option.
Your app generates a new 6-digit code every 30 seconds. Type the current code into **Verification Code** and click **Verify & Enable**.
Once the code checks out, the dialog closes and the badge changes to **Enabled**.
### Turning off 2FA
Click **Disable** next to the Authenticator App entry. The factor is removed right away with no extra confirmation, so the next time you log in only your password is required.
If your account has owner-level access to a live loyalty program, turning off 2FA without a replacement leaves the account protected only by a password. Worth keeping 2FA on.
## Active sessions
The Active Sessions section shows your current login: the email address and when the session expires.
**Sign Out All Sessions** ends every active session across all browsers and devices at once. You're redirected to the login page immediately. Use this if you've left yourself logged in somewhere you shouldn't have, or if you suspect unauthorised access.
Owners can always reach it. For managers and staff, the settings permission needs to be turned on. Go to **Staff → \[staff member's name] → Permissions** to check or change it.
Any TOTP-compatible app works. Google Authenticator and Authy are the most widely used. Microsoft Authenticator and 1Password's built-in authenticator both work fine.
There's no self-serve recovery for a lost TOTP factor. Contact Qtap support to regain access to your account.
No. It ends your own sessions only, not sessions belonging to other staff accounts on the same organisation.
Control which staff members can access Settings and other dashboard areas.
Manage your plan, add-ons, and payment details.