Account and payment
Sign-in security: passkey, code, sessions
How to protect a ZRAZU account: add a passkey or an app code, save backup codes, change the password and email, close other sessions and recover access.
A ZRAZU account controls domains and money, so it is worth protecting with a second sign-in step. Set it up under Settings → Sign-in security.
The second sign-in step
The second step is what we ask for after the password. There are two ways; one is enough:
- Passkey — your device's fingerprint, face or PIN instead of a code. Faster than a password, and it can't be stolen on a fake site.
- Code from an app — six digits from an authenticator app (Google Authenticator, Authy, 1Password).
We don't use SMS for sign-in — only for notifications: a phone number is easy to hijack.
Without a second step, sign-in relies on the password alone, and risky domain actions (such as changing name servers or removing the lock) stay closed until you set it up. After sign-in the dashboard may offer to set it up — choose "Create a passkey" or "Code from an app". "Later" reminds you in a month, "Don't ask again" turns the reminder off.
Add a passkey
- Open "Sign-in security" and, under "Passkeys", click "Add a passkey".
- Give it a name ("phone", "laptop") so you can recognize it later.
- Confirm with a fingerprint, face or PIN in the browser window.
Next to each key you see when it was added and when it was last used. Click "Remove" to delete it — except the last way to confirm sign-in.
Connect a code from an app
- Under "Code from an app", click "Connect".
- Scan the QR code with the app. If that doesn't work, enter the shown secret manually.
- Type the six-digit code and click "Confirm".
The status changes to "connected". To switch phones, use "Replace app".
The secret and the QR code are a key to your account: never show them to anyone or send them in a chat.
Backup codes
When you connect a second step we show 10 single-use backup codes. You need them if you lose your phone.
- Save them right away: download the file or click "Copy all". We won't show them again.
- Each code works once. How many are left is shown under "Backup codes".
- "Regenerate" creates new ones; the old ones stop working.
Password and email
- Change password — enter the current one and the new one (at least 12 characters). Other sessions are closed afterwards.
- Set a password — if you signed up with Google or sign in by link, you can set a first password without an old one, confirming with a code.
- Change sign-in email — enter the new address and click "Send confirmation". A confirmation email goes to the new address and a warning to the current one.
After you change the password or email, domain transfers are unavailable for 72 hours: no transfer code is issued meanwhile. That way nobody can take a domain right after a break-in.
Sign in with Google
You can connect Google with "Connect Google". Google replaces only the password: risky actions still need a second step. You can disconnect Google if you have a password or a passkey.
Sessions
Under "Sessions" you see the devices you are signed in on. Yours is marked "this device".
- "Sign out" closes one session.
- "Sign out everywhere except here" closes the rest.
We close inactive sessions ourselves. For every sign-in from a new device we send an email with a "Not me" button.
If you lose access
Open "If you lose access" → "How to recover access". The path depends on your situation:
| Situation | What happens |
|---|---|
| Email yes, phone no | Confirm by email; we reset the second step after 24 hours, notifying all your contacts |
| Neither email nor phone | An ID document and account history, 72 hours of waiting, confirmed by a second person |
| A company | A request on letterhead, a state register check, 72 hours and two staff members |
We never verify identity by phone. When in doubt, we refuse — even if you really are the owner: better to wait than to lose the domain.
Do you have backup codes? Then just enter one of them instead of the app code on the sign-in step — and after signing in, replace the app and generate new codes.
If it didn't work
- "The code didn't match — check the time on your phone" — the code depends on time; turn on automatic time.
- "This is the last way to confirm sign-in" — add another key or app first, then remove this one.
- "The current password didn't match" — check the layout and Caps Lock, or use "Forgot your password?" on the sign-in page.
- "This Google account is already connected to another ZRAZU account" — use a different Google account.
- "To connect Google, confirm your sign-in again" — sign in again and repeat.