What is Security?
The Timer Security page is your central hub for protecting your account. It gives you a real-time Security Score, lets you manage your password, enable two-factor authentication (2FA), set a recovery email, monitor active sessions across all your devices, and review recent login activity — all from a single, intuitive interface.
Pro Tip: Your Security Score is calculated from four factors: password freshness (or OAuth provider), 2FA status, recovery email, and suspicious activity. Aim for a score of 70 or above to keep your account in the "Excellent" range.
Key Features
Security Score
A visual ring gauge scores your account from 0 to 100 based on password age, 2FA, recovery email, and activity history. Color-coded red, amber, or green so you can assess your protection level at a glance.
Password Management
Change your existing password or create one alongside your Google OAuth login. Real-time requirement indicators confirm length, number, and special character rules as you type.
Two-Factor Authentication
A guided three-step setup (Scan, Verify, Backup) walks you through enabling TOTP-based 2FA with any authenticator app. Backup codes are generated automatically for emergency access.
Session Management
View every device currently signed into your account with device type, location, and last activity time. Sign out individual devices or all other sessions with one click.
Core Workflow
-
1
Check Your Security Score
When you open the Security page, the hero section displays your current score in a circular ring gauge along with key stats: password age, active session count, and 2FA status. If the score is below 70, look for the alert banner below the hero for specific recommendations.
-
2
Update Your Password
Click Change on the Password card to open the password drawer. Enter your current password (or request a verification code if you use Google OAuth), then type and confirm a new password that meets all three requirements: at least 8 characters, contains a number, and contains a special character.
-
3
Enable Two-Factor Authentication
Click Enable on the Two-Factor card. In Step 1, scan the QR code with your authenticator app (or enter the manual code). In Step 2, enter the 6-digit code from the app to verify. In Step 3, save the one-time-use backup codes by downloading or copying them.
-
4
Set a Recovery Email
Click Add on the Recovery card and enter a backup email address that is different from your login email. This email is used to regain access if you forget your password or lose your authenticator device.
-
5
Review Sessions and Activity
Scroll down to the Active Sessions section to see all signed-in devices. Remove any you do not recognize by clicking Sign Out, or use Sign Out All Others to revoke every session except your current one. Check the Recent Activity feed for any failed login attempts or unexpected changes.
Security Settings
The Security page organizes your protection options into three module cards and two monitoring sections:
Password Card
Shows your password age (e.g., "3 days ago") or your OAuth provider name if you signed up with Google. The drawer enforces three requirements: minimum 8 characters, at least one number, and at least one special character. OAuth users receive a verification code by email before creating a password.
Two-Factor Card
Displays a status dot (green for enabled, gray for disabled) and a button to Enable or Manage 2FA. The setup drawer uses a three-step wizard: scan QR code, verify with a 6-digit TOTP code, and save backup codes. Once enabled, you can view remaining backup codes or disable 2FA from the same drawer.
Recovery Card
Shows your masked recovery email (e.g., "j***[email protected]") or "Not set" if none has been configured. Click Add or Change to open the recovery drawer and enter a backup email address for account recovery.
Active Sessions
Lists every device signed into your account with device icon, device name, location, last activity time, and a Current badge for your present session. Includes pagination for accounts with many sessions, a Refresh button, and a Sign Out All Others button.
Recent Activity
Displays the latest login events, password changes, and 2FA modifications with success or failure indicators, location, and relative timestamps. Click View All to see your complete activity history.
Best Practices
Enable Two-Factor Authentication
2FA is worth 40 points of your Security Score — the single largest factor. Enabling it with an authenticator app like Google Authenticator or Authy dramatically reduces the risk of unauthorized access even if your password is compromised.
Rotate Your Password Regularly
Passwords less than 30 days old earn the maximum 30 score points. Aim to update your password at least every 90 days. The password drawer enforces strong requirements: 8+ characters, a number, and a special character.
Set a Recovery Email
A recovery email is your safety net if you lose access to your password and authenticator. Use a different email address than your Timer login email and make sure it is an account you can always access.
Audit Active Sessions Weekly
Check the Active Sessions list regularly for devices or locations you do not recognize. If anything looks suspicious, sign out that session immediately and change your password as a precaution.
Store Backup Codes Safely
When you enable 2FA, download or copy your backup codes and store them in a secure location such as a password manager or a locked physical document. Each code can only be used once, so keep them safe for emergencies.
Frequently Asked Questions
How is the Security Score calculated?
The score is a sum of four components: Password freshness or OAuth login (up to 30 points), Two-Factor Authentication enabled (40 points), Recovery email configured (15 points), and No suspicious login activity (15 points). A score of 100 means all protections are active and your account has no flagged events.
I signed up with Google. Do I need a password?
No — Google OAuth users receive full password score points automatically because Google handles authentication. However, you can optionally create a Timer password by clicking Create on the Password card. A verification code will be sent to your email to confirm your identity before the password is set.
What happens if I lose my authenticator device?
Use one of your backup codes to sign in. Each backup code can only be used once. If you have also lost your backup codes, use your recovery email to regain access to your account and then reconfigure 2FA with a new device.
Can I sign out all devices at once?
Yes. In the Active Sessions section, click Sign Out All Others to terminate every session except the one you are currently using. This is useful if you suspect unauthorized access or if you have signed in on a shared or public computer.
Why do I see a security alert banner?
The alert banner appears when your account has actionable recommendations — for example, 2FA is not enabled, your password is older than 90 days, or no recovery email is set. Each recommendation links to the corresponding module card so you can resolve it quickly and improve your Security Score.