---
title: Sign-in methods
description: Password, one-time email code, Google, GitHub, and two-factor — the ways sherlock authenticates you.
---

# Sign-in methods

sherlock supports several ways to prove it's you, and an account can
have more than one active at once.

## Password

The usual email-and-password pair. Set or change it from the account
page's sign-in methods tab; a password is optional — plenty of accounts
never set one and sign in with a one-time code or a social provider
instead.

## One-time email code

A six-digit code sent to your email, entered directly in the sign-in
form — not a magic link you click. It expires quickly and is single-use,
so a code emailed to you can't be replayed later.

## Google and GitHub

Sign in through either provider's own OAuth flow instead of an email and
password. sherlock links the resulting identity to your account by
email; the first sign-in with a given provider creates the account if
one doesn't already exist for that email.

## Two-factor authentication

An optional second step on top of a password: enable it from the
account page, scan the QR code with an authenticator app, and confirm
with the six-digit code it produces. Once enabled, signing in with a
password also requires that code. Two-factor can only be enabled once a
password is set — there's no second factor to add to a passwordless
account.

Disabling two-factor asks for confirmation before it takes effect,
since it's a real reduction in how hard the account is to break into.

## Next

[Sign in with sherlock (redirect)](/sherlock/sign-in-with-sherlock-by-redirect)
— using sherlock as the identity provider for a different app entirely.