Trusted devices and 2FA

When you log in from a new browser or unknown IP, we email you a 6-digit code to verify.

**Trust a device**
On the code entry screen, tick **Trust this device for 30 days**. We set a secure cookie on that browser + store a hash on our side. Next login from the same browser skips the code entirely.

**Manage trusted devices**
**Settings → Trusted Devices** shows every active device linked to your account — IP, user-agent, last used, expiry. Tap **Revoke** to kick a device off. **Sign out everywhere** nukes every active device in one click (useful if you lose your phone).

Trusted-device tokens expire automatically after 30 days regardless. The raw token only lives in the browser cookie; we only store its hash.