GuidesOnly show guides for your app
GuidesGuidesYour Falix account holds every server you own — and its password is also your SFTP login. Here's how to lock it down: a strong password, two-factor authentication, passkeys, and knowing what your active sessions page can do.
Your Falix account is the master key to every server you own. If someone gets into it, they get into all of them — files, databases, the lot. The good news: locking it down takes about ten minutes, and this guide covers the whole job — a strong password, two-factor authentication, passkeys, and the sessions page that shows you who's logged in.
| At a glance | |
|---|---|
| You need | your Falix account |
| Plan | any — all of this is free |
| Time | ten minutes |
| Where | your Profile pages: password and 2FA under Settings, plus Sessions and Passkeys |
Start here, because this one's easy to miss: your Falix account password is also your SFTP password. The same password you log in with is what an SFTP client uses to reach your server files (see Connecting over SFTP). There's no separate SFTP credential — so a weak account password is a weak file-transfer password too.
That makes the basics matter more than usual:
⚠️ Heads up: Changing your password signs you out on every device and issues a fresh session everywhere. That's on purpose — if you ever suspect someone else is in, changing your password is the fastest way to kick them out of all sessions at once.
Two-factor authentication (2FA) means a password alone isn't enough to log in — you also need a code from your phone. It's the single biggest upgrade to your account's safety.
Falix uses authenticator-app 2FA (the standard TOTP kind — Google Authenticator, Authy, 1Password, and the like). To turn it on, open the 2FA setup from your profile:
That's it — from now on, logging in asks for your app's current code. You can turn 2FA off again from the same profile area if you ever need to.
💡 Tip: Store the backup code in your password manager the moment it's shown. If you lose your phone and your backup code, getting back in becomes a support problem instead of a ten-second one.
Falix also supports passkeys (the WebAuthn standard): a fingerprint, face unlock, or a hardware security key stands in for typing a password. Add one from the Passkeys page in your profile — you give it a name, and your device does the rest. Each passkey shows when it was added and last used, and you can remove one anytime. Passkeys are a strong, phishing-resistant way in; add one as a second method even if you keep app-based 2FA.
Once 2FA is on, it doesn't only guard the login screen. Falix re-asks for your code before sensitive actions, so even someone at an already-open session can't quietly do damage. The ones worth knowing:
| Sensitive action | With 2FA on… |
|---|---|
| Adding or removing an SSH key (SFTP) | asks for your 2FA code |
| Any sub-user change (inviting, editing, removing) | asks for your 2FA code |
| Requesting account deletion | asks for your 2FA code |
The theme: anything that changes who can reach your servers gets a second check. This is exactly why turning 2FA on is worth the ten minutes — it hardens the actions that matter most.
Your profile has a Sessions page that lists every place your account is currently signed in. For each session it shows the device (desktop, mobile, tablet), the browser, an approximate location, and the IP address — with a badge marking the one you're using right now.
Two controls keep you in charge:
🎯 Good to know: Seeing a session you don't recognise is your cue to act: terminate it, sign out everywhere else, then change your password (which also ends all sessions) and make sure 2FA is on.