Protecting Your Account

Your account is safest when three things are true: your password is strong and private, only you can receive your codes, and you pay attention to security alerts.

Make your password strong

• Long beats complicated: a phrase of four or more unrelated words is strong and memorable.
• Use a different password on Xacheus than on your email and other apps.
• Never share it with anyone — Xacheus staff will never ask for your password.

Guard your email and phone

Your email address is the identity of your Xacheus account: anyone who controls it can request a password reset. Protect it with its own strong password and its own verification.

Read your security alerts

Xacheus can alert you when your account is opened from a new device. When one arrives:

• It was you — nothing to do; the alert is just information.
• It was not you — change your password immediately, sign out other sessions if offered, and check your email account too, because that is how an attacker would reset it. Then report it.

Watch for phishing

Most account takeovers start with a trick, not a hack: a fake "verify your account" message or a login page that only looks like Xacheus. Learn the signs in Recognizing phishing attempts. Xacheus also warns you before you open a link that has been flagged.

Use the tools Xacheus gives you

• Block anyone harassing you.
• Report suspicious messages and posts.
• Sign out on devices you do not control — public computers, borrowed phones.

If the worst happens

Read Recovering a compromised account and act quickly; fast action usually recovers everything.