# Creating your account

> Signing up, verifying your email, and setting up two-factor authentication, which is required rather than optional. Plus what to do when you change phone.

Signing up takes an email address and a password. Two things then happen that are worth knowing
about in advance.

## Verify your email

Gylder sends a verification email. Until you follow it, the account is not usable.

If it has not arrived, check spam before requesting another. The sender is `gylder.nl`.

## Two-factor authentication is required

Gylder enforces 2FA on every account. It is not a setting you can decline, and it is asked for at
every login.

That is a deliberate trade of convenience for safety. Your Gylder account aggregates the full
picture of your finances, which makes it a more attractive target than any single account it reads
from. A password alone is not enough protection for that.

**To set it up**, scan the QR code with an authenticator app such as Google Authenticator or Authy,
then enter the six-digit code to confirm. If you cannot scan, there is a code you can copy and type
into the app by hand.

The app generates a new code every 30 seconds. If a code is rejected, the usual cause is that it
expired while you were typing, so wait for the next one rather than assuming something is broken.

## Save your recovery method now

The moment to think about losing your phone is before you lose it.

Most authenticator apps offer a backup or sync feature. Turn it on, or write down the setup code
somewhere safe when you first configure 2FA. It takes a minute now and saves a support conversation
later.

## Changing phone or switching apps

There is a **reset** for your authenticator under **Settings → Security**. Use it when you get a new
phone or move to a different app.

One thing to plan around: **your old authenticator stops working the moment you confirm the new
one**. Do this while you still have access to the old device, not after you have wiped it.

## Signing in

Every login asks for your password and a current authenticator code.

Sessions expire and are not indefinite, so you will be asked to log in again periodically. That is
intentional for the same reason 2FA is.

## What to do next

With the account set up, the next step is getting your money into it. Depending on what you hold,
that means [importing a DeGiro CSV](/guides/importing-a-degiro-csv),
[connecting a crypto exchange](/guides/connecting-a-crypto-exchange), or
[adding things by hand](/guides/adding-a-manual-asset).

Then [reading your dashboard](/getting-started/reading-your-dashboard) explains what it is telling
you.