upstream-mattermost/docs/main/end-user-guide/preferences/manage-your-security-preferences.mdx

---
title: "Manage your security preferences"
---
import useBaseUrl from '@docusaurus/useBaseUrl';

<PlanAvailability slug="all-commercial" />

Select your profile picture, select **Profile**, and then select **Security** to configure your password, view access history, and to view or logout of active sessions.

<table style={{width: '99%'}}>
<colgroup>
<col style={{width: '20%'}} />
<col style={{width: '80%'}} />
</colgroup>
<thead>
<tr>
<th scope="col">Security setting</th>
<th scope="col">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>Password</td>
<td><p>You may change your password if you've logged in by email using Mattermost in a web browser or using the desktop app.</p><Important><ul><li>If you sign in to Mattermost using a single sign-on service, you must update your password through your SSO service account.</li><li><strong>Password Security Enhancement</strong>: From v11.0, Mattermost uses PBKDF2 password hashing for improved security. When you log in after your server upgrades to v11.0+, your password will be automatically migrated to the more secure format. If your server is later downgraded to a version prior to v11.0, you may be unable to log in and will need to contact your system administrator for a password reset.</li></ul></Important></td>
</tr>
<tr>
<td>Multi-factor authentication (MFA)</td>
<td><p>If your system admin has enabled <a href="/administration-guide/configure/authentication-configuration-settings#enable-multi-factor-authentication">multi-factor authentication</a> (MFA), you can require a passcode in addition to your password to log-in to your Mattermost account.</p><p>You'll need to download a MFA passcode generation app, such as Google Authenticator or a similar app, and then set-up MFA in your Mattermost account.</p><p><strong>Download a passcode generation app</strong></p><ul><li>Download Google Authenticator for an Apple device from <a href="https://apps.apple.com/us/app/google-authenticator/id388497605">iTunes</a></li><li>Download Google Authenticator for an Android device from <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&amp;hl=en">Google Play</a></li></ul><p><strong>Enable MFA in Mattermost</strong></p><ol><li>Open Mattermost in a web browser or the desktop app.</li><li>In Mattermost, from your profile picture, select <strong>Profile &gt; Security</strong>.</li><li>Under <strong>Multi-factor Authentication</strong>, select <strong>Edit</strong>.<p><img src={useBaseUrl('/images/multi-factor-authentication.png')} alt="Enable multi-factor authentication through your Mattermost user profile." /></p></li><li>Select <strong>Add MFA to Account</strong>.<p><img src={useBaseUrl('/images/add-mfa-to-account.png')} alt="Add multi-factor authentication to your Mattermost user profile." /></p></li><li>Scan the QR code or enter the <strong>Secret</strong> provided by Mattermost into the authenticator app.</li><li>In Mattermost, enter the <strong>MFA Code</strong> generated by the authenticator app.</li><li>Select <strong>Save</strong>.</li></ol></td>
</tr>
<tr>
<td>Sign-in method</td>
<td><p>This option allows you to switch your login method between using email/username and password and <a href="/end-user-guide/access/access-your-workspace#single-sign-on-sso">single sign-on credentials</a>.</p><p>You can configure this setting using Mattermost in a web browser or using the desktop app.</p><Note><p>While you can choose to log in with either set of credentials, you can only enable one login method at a time. For example, if AD/LDAP single sign-on is enabled, you can select <strong>Switch to using AD/LDAP</strong>, and enter your AD/LDAP credentials to switch login over to AD/LDAP. You'll need to enter the password for your email account to verify your existing credentials. Following the change, you'll receive an email to confirm the action.</p></Note></td>
</tr>
<tr>
<td>View access history</td>
<td><p>Using Mattermost in a browser or using the desktop app, you can access a chronological list of the last 20 login and logout attempts, channel creations and deletions, account settings changes, or channel setting modifications made with your account.</p><p>The details of the Session ID, which is a unique identifier for each Mattermost browser session, and IP Address of the action is recorded for audit log purposes.</p></td>
</tr>
<tr>
<td>View and log out of active sessions</td>
<td><p>Sessions are created when you log in with your credentials a new browser on a device. Sessions let you use Mattermost for up to 30 days without having to log in again.</p><p>Using Mattermost in a browser or using the desktop app:</p><ul><li>Select <strong>Logout</strong> during an active session if you want to revoke automatic login privileges for a specific browser or device.</li><li>Select <strong>More Info</strong> to view browser and system details.</li></ul></td>
</tr>
</tbody>
</table>