RecurPost Account Security: two-factor authentication, password rules and device sign-out
RecurPost protects your sign-in with three controls in Account Settings: two-factor authentication, password rules and a list of every device and browser you’re signed in on.
One RecurPost login reaches every client profile connected to it. A leaked password would let a stranger publish to all of them. RecurPost includes all three controls on every plan.
No credit card required
RecurPost account security covers three controls in Account Settings
RecurPost account security consists of three controls. All three sit in the Account group of Account Settings.
RecurPost gives every plan the same three controls. An agency owner with 20 client profiles on the Agency plan sees exactly what a freelancer with 5 profiles on the Personal plan sees.
RecurPost’s account security protects your RecurPost login. It doesn’t cover your clients’ own Facebook or Instagram passwords. RecurPost keeps those passwords out of your hands from the start, because clients connect their own accounts through a password-free invite. That invite is one of the RecurPost collaboration and engagement features.
Two-factor authentication (2FA)
Stops a stolen password from signing in on its own.
Where: Account Settings > Password & security.
Password rules
Stops short passwords and passwords with only one kind of character.
Where: Account Settings > Password & security.
Devices & browsers
Ends old sessions left open on phones and computers you no longer use.
Where: Account Settings > Devices & browsers.
Two-factor authentication asks for a 6-digit code after your password
RecurPost two-factor authentication asks for a 6-digit code from an authenticator app after you enter your password. A stolen password stops being enough on its own. The RecurPost iOS and Android apps ask for the same code when you sign in on your phone.
RecurPost 2FA works with Google Authenticator, Microsoft Authenticator and Authy. The RecurPost sign-in screen accepts three kinds of code:
Authenticator app
The 6-digit code from Google Authenticator, Microsoft Authenticator or Authy.
Use email instead
A 6-digit code sent to your login email. It stays valid for 10 minutes, with a Resend link.
Use recovery code
One of your 10 saved recovery codes. Each code works once.
In practice: Someone signing in with your password from another country reaches the “Two-factor authentication” screen and has no code to give. After five wrong codes, RecurPost sends them back to the login page.
Fits
Anyone who can install Google Authenticator, Microsoft Authenticator or Authy on a phone.
Does not fit
A team member without a phone that can run an authenticator app. The emailed code is an extra way in once 2FA is running. It doesn't replace the app at setup.
Setting up 2FA takes one QR code and one 6-digit code
RecurPost leaves 2FA off until you set it up. RecurPost turns it on from Account Settings > Password & security in five steps:
- Open Account Settings > Password & security.
- Click Set up 2FA on the Two-factor authentication (2FA) card.
- Scan the QR code with your authenticator app. If the camera can’t read it, type the key shown under the code.
- Type the 6-digit code from the app and click Verify & Activate.
- Save your 10 recovery codes with Copy codes or Download .txt.
RecurPost then marks the card Enabled and adds two links: Recovery codes and Turn off. RecurPost switches Email backup on by default, so a code sent to your login email can also get you in. Turn Email backup off if you want the app and your recovery codes to be the only ways in.
In practice: A freelancer with a laptop and a phone finishes the whole setup in one sitting, then saves the 10 recovery codes to a password manager.
RecurPost two-factor setup: scan the QR code, enter the 6-digit code, save 10 recovery codes.
Fits
Recovery codes kept in a password manager or on a printed sheet.
Does not fit
Codes saved only on the phone that runs your authenticator app. They go missing with it.
Recovery codes and email codes get you back in without your phone
RecurPost gives you 10 one-time recovery codes when you set up two-factor authentication. Each code works for one sign-in.
RecurPost asks for your current password before it issues a new set of codes. RecurPost then stops accepting the old set, so codes printed and left somewhere no longer work.
RecurPost also asks for your current password before it turns 2FA off. The “Disable 2FA?” window warns that turning it off reduces your account security. A person who finds your laptop with RecurPost open still can’t switch 2FA off without your password.
In practice: An account manager’s phone goes missing on a client trip. The account manager signs in with one recovery code from a password manager, or with the emailed code unless Email backup was turned off. Back at the desk, the account manager opens Recovery codes, enters the current password and gets 10 new codes.
Fits
Codes stored away from your phone, with Email backup left on as a second way in.
Not what it does
Recover an account when the codes are gone and the login email is out of reach too. RecurPost support handles that case.
Three actions that ask for your current password
Getting a new set of recovery codes.
Turning two-factor authentication off.
Changing your password.
RecurPost recovery codes: a new set of 10 replaces the old one, and turning 2FA off needs your password.
RecurPost passwords need 8 to 20 characters and four character types
RecurPost requires five things in a new password, and each rule ticks off as you type. RecurPost shows a strength bar under the New password field and uses the same checklist at sign-up. Each password field has a show/hide toggle.
RecurPost changes a password through three fields: Current password, New password and Confirm password. Click Update password to save. RecurPost then signs out your other sessions, which makes a password change the quickest way to end every session at once.
RecurPost caps passwords at 20 characters. Password managers that generate 32-character passwords by default need their length set to 20 or fewer for RecurPost.
In practice: A team member who tries an old 6-character password sees which rules are still missing before RecurPost accepts it.
Fits
Changing a password you think is exposed. Every other session signs out with it.
Does not fit
Ending one session and keeping the rest open. Use Devices & browsers for that.
8 to 20 characters
The length RecurPost accepts.
1 uppercase letter
At least one, A to Z.
1 lowercase letter
At least one, a to z.
1 number
At least one digit, 0 to 9.
1 symbol
At least one character such as ! or #.
RecurPost shows these five rules as a checklist under the New password field.
Devices & browsers lists every signed-in session and signs one out
RecurPost lists every device and browser signed in to your account under Account Settings > Devices & browsers. The page has two lists.
RecurPost signs out another browser in one click. RecurPost’s old Your devices page listed phones only, so browser sessions are new to this page.
Device
Phones running the RecurPost mobile app, with the date added, Signed in status and a remove button.
Browser
Web sessions. The browser you're using comes first, marked Current device. Every other row shows its last-active time, IP address, date added and a sign-out button.
In practice: A freelancer who signed in on a co-working desk computer removes that session from home the same evening. An agency owner removes a former contractor’s phone from the owner login after the handover.
Fits
Spotting a browser or IP address you don't recognise on your own login.
Does not replace
Removing a teammate. The list shows your own login only. RecurPost removes a teammate's access to client workspaces through Team > Members.
RecurPost Devices & browsers: the current browser first, every other session with its own sign-out button.
Why agencies turn on 2FA: one login reaches every client's profiles
RecurPost opens every client workspace your role allows from a single login. One RecurPost password therefore guards every client profile in those workspaces at once. RecurPost two-factor authentication matters most for agencies, freelancers with client accounts and any team where more than one person signs in.
RecurPost sets two-factor authentication per login, and RecurPost has no setting that lets an account owner require 2FA for the whole team. RecurPost’s two-factor authentication doesn’t replace roles either. RecurPost roles and permissions decide what a person can do after signing in. Two-factor authentication decides who can sign in at all.
RecurPost describes how it protects its own servers, data and staff access in RecurPost security practices.
In practice: A 5-person agency running 20 client accounts on the Agency plan has five RecurPost logins. Each of the five people opens their own Account Settings and turns 2FA on, because each login reaches the client workspaces its role allows. A writer with a valid login and a valid code still can’t publish to a client account if the writer’s role doesn’t allow it.
Fits
Agencies, freelancers with client accounts and any team where more than one person signs in.
Does not fit
An owner who wants to force 2FA on every member. RecurPost has no team-wide setting, so each member sets it up.
Account security FAQs
Does RecurPost support two-factor authentication?
Yes. RecurPost supports two-factor authentication on every plan, under Account Settings > Password & security. RecurPost leaves it off until you click Set up 2FA.
Which authenticator apps work with RecurPost?
RecurPost two-factor authentication works with Google Authenticator, Microsoft Authenticator and Authy. You scan a QR code during setup, or type the key shown under it.
What if I lose my phone after turning on 2FA?
RecurPost lets you sign in with one of your 10 recovery codes, or with a code sent to your login email unless you have turned Email backup off. Once you’re back in, open Recovery codes and enter your password. RecurPost issues 10 new codes and the old ones stop working.
How do I turn off two-factor authentication in RecurPost?
RecurPost turns off two-factor authentication from Password & security after you confirm your password. Click Turn off on the 2FA card, enter your current password and click Turn off 2FA.
What are RecurPost's password requirements?
A RecurPost password needs 8 to 20 characters, with at least 1 uppercase letter, 1 lowercase letter, 1 number and 1 symbol. The checklist under the New password field ticks off each rule as you type.
How do I sign out of RecurPost on another device?
RecurPost signs out a device from Account Settings > Devices & browsers, one entry at a time. Click the sign-out button on that browser or phone. Changing your password signs out every other session at once.
Does 2FA apply to my team members?
RecurPost two-factor authentication is set per login, so each team member turns it on in their own Account Settings. An account owner can’t require it for the whole team.
Does 2FA work on the RecurPost mobile app?
Yes. The RecurPost iOS and Android apps ask for your two-factor code when you sign in.
Try RecurPost
RecurPost includes two-factor authentication, password rules and device sign-out on every plan, including the 14-day free trial. RecurPost’s Agency plan covers 20 social accounts and includes 3 team members. RecurPost prices an extra teammate at a flat $20 per month on any plan instead of multiplying the plan price by every seat.
Start a 14-day free trial with no credit card, or compare RecurPost plans to see every allowance and add-on. Account security works alongside scheduling, approvals and reporting in RecurPost social media management software.