Quick answer
Go to Settings and open Security. There you can change your password, turn on two-factor authentication with an authenticator app, and sign out of your other sessions. Use a strong password, never share your account, and always sign out on shared devices.
How do I change my password?
Open Security
Go to Settings → Security.Enter current password
Type your current password to confirm it is you.Set a strong new one
Choose a long password with letters, numbers and symbols.Save
Save it. Use the new password next time you sign in.
A strong password is long and unique. Never reuse a password from another website.
How do I turn on two-factor authentication?
Two-factor authentication adds a second step at sign-in: a six-digit code from an app on your phone. Even if someone learns your password, they cannot get in without that code.
Open Security
Go to Settings → Security and find Two-factor authentication.Start setup
Choose Set up two-factor. A QR code appears.Scan it
Scan the QR code with an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password. If your app cannot scan, type in the setup key shown underneath.Confirm
Enter the six-digit code your app shows. Two-factor is on only once that code is accepted.
The setup key is shown only during setup. Once two-factor is on it cannot be displayed again — if you need it on another phone, remove the authenticator and set it up afresh.
How do I turn two-factor off?
On the Security page, choose the bin icon next to your authenticator and enter a current six-digit code. Removing it needs a live code on purpose: that is how we know it is you and not someone sitting at a device you left signed in.
What if I lose my phone?
Ask your HR admin to raise it with ASHR support. Support can clear the authenticator on your account so you can set up a new one at your next sign-in — your password is not changed and nobody is signed in on your behalf. Every clearance is recorded in your organisation's audit log, with who did it and why.
There are no printed backup codes. If you use an authenticator app that syncs across your devices, or keep a second device enrolled, you will not need this path at all.
Where am I signed in?
The Security page shows the session you are using now — when you signed in, and how. It does not show a list of your other devices: the sign-in service ASHR uses does not report them, and we would rather show you nothing than a list we made up.
What you can always do is end those sessions:
- Sign out other sessions — everything except the device you are on stays signed out.
- Sign out everywhere, including here — ends every session, including this one.
If you see anything you do not recognise, sign out of your other sessions and then change your password.
Does my organisation require two-factor?
Anyone can turn it on. It is required for the ASHR platform console used by our own staff, which is why nobody at ASHR reaches that console with a password alone. Your own admins may ask your team to turn it on as a matter of policy.
How do I stay safe day to day?
A few simple habits keep your account secure:
- Turn on two-factor — it is the single biggest improvement you can make.
- Do not share your account with anyone.
- Sign out when using a shared or public computer.
- Depending on your org, you may sign in with email or Google — use whichever your admin set up.
Small steps like these keep your personal HR data private.
Frequently asked questions
- What makes a strong password?
- Make it long, mix letters, numbers and symbols, and never reuse it from another site.
- I sign in with Google — can I change my password here?
- If your org uses Google sign-in, you manage that password in your Google account, not here.
- Can I see a list of my devices?
- No. ASHR cannot list your devices, because the sign-in service does not report them. You can still sign out of your other sessions from the Security page.
- What if I lose the phone with my authenticator?
- Ask your HR admin to raise it with ASHR support, who can clear the authenticator on your account so you can set up a new one. Your password is not changed.
This guide also lives in the help centre at /help/settings/security, which is its canonical home.