Account Security

Enable two-factor authentication, manage sessions, and configure security notifications.

Security Overview

Your Legacy Key account protects sensitive information about your cryptocurrency holdings. We provide multiple layers of security to keep your data safe.

For detailed technical information about our security implementation, see our Security Documentation.

Two-Factor Authentication

Two-factor authentication (2FA) adds an extra layer of protection beyond your password. Even if someone obtains your password, they cannot access your account without the second factor.

Enabling 2FA

If you didn't set up 2FA during registration:

  1. Go to Settings → Security
  2. Click Enable Two-Factor Authentication
  3. Scan the QR code with your authenticator app
  4. Enter the 6-digit code to verify
  5. Save your backup codes

Backup Codes

When you enable 2FA, you receive 10 one-time backup codes. Each code carries 80 bits of entropy and is formatted as five hexadecimal groups (XXXX-XXXX-XXXX-XXXX-XXXX). Use one if you ever lose access to your authenticator app.

Backup codes are different from your Recovery Key. Backup codes recover MFA only — they don't restore access if you forget your password. For that, you need your LK- Recovery Key. See the Recovery Key guide.

Critical: Store your backup codes securely (e.g., in a password manager or printed in a safe place). If you lose access to your authenticator and don't have backup codes, you may lose access to your account.

Disabling 2FA

To disable 2FA, go to Security settings and click Disable 2FA. You'll need to verify with your current code. We don't recommend disabling 2FA, but the option is available if needed.

Password Security

Your password must meet these requirements:

  • Minimum 12 characters
  • At least one uppercase letter (A-Z)
  • At least one lowercase letter (a-z)
  • At least one number (0-9)
  • At least one special character (!@#$%^&*...)

Changing Your Password

  1. Go to Settings → Security
  2. Click Change Password
  3. Enter your current password
  4. Enter and confirm your new password
  5. Verify with your 2FA code (if enabled)

When you change your password, all other sessions are automatically logged out for security.

Session Management

Legacy Key lets you view and manage all devices where you're logged in.

Viewing Active Sessions

Go to Settings → Sessions to see all active sessions:

  • Device type and browser
  • Approximate location (based on IP)
  • Last activity time
  • Whether it's your current session

Revoking Sessions

If you see a session you don't recognize, or want to log out a device remotely:

  1. Find the session in the list
  2. Click Revoke
  3. The device will be immediately logged out

You can also click Revoke All Other Sessions to log out everywhere except your current device.

If you see unfamiliar sessions: Revoke them immediately, change your password, and review your account for unauthorized changes.

Security Notifications

Legacy Key sends email alerts for important security events:

Security Alert Types

New device login
When you log in from a new device or browser
Password changed
Confirmation when your password is updated
2FA enabled/disabled
When two-factor authentication settings change
Failed login attempts
After 3 failed login attempts
Session revoked
When a session is remotely logged out

Configuring Notifications

You can customize which alerts you receive in Settings → Notifications. We recommend keeping all security notifications enabled.

Account Lockout Protection

To protect against brute-force attacks:

  • Login attempts: After 5 failed attempts, login is temporarily blocked for 15 minutes
  • MFA attempts: After 5 failed 2FA codes, account is locked for 15 minutes
  • Password reset: Limited to 5 requests per 15 minutes per email address (shares the login rate limiter)

If you're locked out, wait for the lockout period to expire or contact support.

Data Export

You can export all your data at any time:

  1. Go to Settings → Data
  2. Click Export My Data
  3. Verify with your password and 2FA code
  4. Download the JSON file containing all your data

The export includes all wallets, backup locations, verification history, and settings. This ensures you always have access to your information.

Deleting Your Account

If you decide to delete your account:

  1. Go to Settings → Account
  2. Click Delete Account
  3. Confirm by entering your password and 2FA code
  4. Your data will be permanently deleted

Warning: Account deletion is permanent and cannot be undone. Export your data first if you want to keep a copy.

Security Best Practices

Follow these practices to keep your account secure:

  • Use a unique password: Don't reuse passwords from other sites
  • Keep 2FA enabled: The single most effective protection
  • Review sessions regularly: Check for unfamiliar devices monthly
  • Keep your email secure: Your email is used for account recovery
  • Don't share credentials: Use the sharing feature instead
  • Log out on shared devices: Always log out on public computers

Getting Help

If you experience any security issues or have questions:

We typically respond within 24 hours for general inquiries and prioritize security reports.

You're All Set!

Congratulations on completing the Legacy Key user guide. Your hardware wallet documentation is now organized, secure, and ready for the future. Remember to verify your wallets regularly and keep your Emergency Access Document updated.