Your account, actually yours: 2FA and Linked Devices

GlassChat Team · 2026-07-11

Security features only matter if people can actually see and control what's happening. This release adds both halves: a second lock on the door, and a window to check who's inside.

Two-step verification

Head to Settings → Two-Step Verification and scan a QR code with any authenticator app — Google Authenticator, Authy, 1Password, whatever you already use. From then on, signing in needs your account and a 6-digit code that changes every 30 seconds.

Three details we sweated:

• Backup codes. Enrollment hands you ten one-time codes, shown exactly once and stored hashed. Lose your phone, not your account.
• Passkeys already count. If you sign in with a passkey, you've already proven possession of your device — we don't nag you for a code on top.
• Turning 2FA off requires a valid code. Someone walking up to your unlocked laptop can't silently strip your protection.

Linked Devices

Settings → Linked Devices lists every active session: the device and browser, when it signed in, and an approximate location on a map. One tap signs any of them out — and it's not a soft sign-out. The session's realtime connections are severed the moment you revoke it, not the next time it happens to refresh.

Why this order

We shipped account security before flashier things because everything else rides on it. Encrypted messages don't help if the account holding the keys is easy to take over.