Asiri never asks for a password. You sign in with a code sent to your email, or with a passkey or an authenticator app. A passkey cannot be phished: it is bound to asiri.ng, so a page that merely looks like Asiri gets nothing.
Who can do this
Anyone with an account can manage their own ways of signing in. No workspace access or role is needed.
Find it
Open Your account from the menu, and choose the Security tab.
Emailed code
A six-digit code sent to your work email. It is always there, because your email address always exists. With Always ask for two steps on, it is only ever the first step.
Authenticator app
Six digits from an app on your phone that change every thirty seconds. It proves you hold the phone, not just the inbox.
- Press Set up beside Authenticator app.
- Scan the QR code with your authenticator app, or copy the secret.
- Enter the six-digit code from your app.
The app is added. To remove it, press Remove and confirm.
Passkeys
Signs you in with your fingerprint, face or device PIN, and counts as two steps on its own.
- Press Add a passkey.
- Follow your browser or device prompt.
- Give the passkey a name you will recognise.
A list shows every passkey you have added. To rename one, press its name. To remove one, press Remove beside it and confirm.
Recovery codes
Ten come with the first passkey or authenticator you add. Each signs you in once if your passkeys and authenticator are lost. They are shown once and cannot be read again, so write them down.
When you remove the last passkey or authenticator, unused recovery codes no longer work.
Always ask for two steps
When this is on, an emailed code or an authenticator code is not enough on its own: signing in asks for a second one. A passkey counts as both, so if you sign in with one you will not notice a difference.
Use the switch beside Always ask for two steps to turn it on or off.
Where you are signed in
Every device this account is signed in on is listed, with its name, location and when it was last used. this device marks where you are now.
- To sign out of another device, press Sign out beside it.
- To sign out of every device including this one, press Sign out everywhere at the end of the list.
Signing out of the current device returns you to the sign-in page.
Common questions
"What if I lose my passkey and authenticator?" Use a recovery code. If you have none left, your workspace owner can re-enrol you. Support cannot, because support proving who you are is exactly the hole the second step exists to close.
"Do I need both a passkey and an authenticator?" No. One is enough. A passkey is the stronger choice.
"Why does the app sometimes ask for two steps?" Either you turned it on yourself, or your workspace asks everyone for two steps.