Signing in and security
How you get into your account, the second factor, Enhanced Security, and the log of everything that touched it.
There is no password. You sign in with a code sent to your email, or with a passkey if you have registered one.
With an email code
Type your email, click Continue with Email, and BlockWill sends a 6-digit code. It submits itself once all six digits are in.
With a passkey
Click Account Passkey on the sign-in page and approve with Face ID, Touch ID, Windows Hello or a hardware key. Faster than the code, and it does not depend on your inbox.
A login passkey is not a vault key. This one gets you into the account; a vault key decrypts what is inside it. They are registered separately and losing one does not affect the other.
Only one session at a time
BlockWill allows a single active session per account, deliberately. Signing in on a new device ends the old session. The old device shows a Signed out from this device notice with the device, IP address and time of the new sign-in, plus a Sign in again button. It appears when the old tab next checks in with the server (about a minute of idle time or a mouse move), not the instant you sign in elsewhere. The new device shows You are the only active session, with Review security and Got it. If you see the first notice without having signed in somewhere yourself, treat it as a warning and check your security log.
Two-factor authentication
A second factor means a stolen inbox is not enough to reach your estate. You find it in Settings, under Sign-in & security.
Click Turn on MFA. Choose Authenticator app (recommended) or Text message.
Scan the QR code with Google Authenticator, Authy, 1Password or similar, then click I've scanned the code. If you cannot scan, use Can't scan? Enter code manually.
Enter the 6-digit code your app shows. The same screen lists your backup codes: save them, tick I have saved my backup codes, then click Verify. A notice about your active session may pop up afterwards.
Backup codes
Each code works once. They are what gets you in when the phone with your authenticator is lost, broken or wiped, so save them somewhere that is not that phone. To see them again, click View codes, then Verify to View Codes, and confirm with an Account Passkey. The codes window has Copy Codes, Download and Regenerate Codes.
Right after you turn on an authenticator app, View codes can fail with "Your backup codes couldn't be loaded right now". Copy or download the codes shown during setup, before you click Verify.
Turning it off
Click Disable MFA, then Yes, Disable MFA, then confirm with an Account Passkey on the verification page. Possible, and not recommended on an account that holds an estate.
Enhanced Security
Enhanced Security locks sign-in to passkeys you have explicitly authorised. Google sign-in and email codes stop working entirely. It is the strongest setting available and it needs at least two Account Passkeys and 2FA already in place before you can turn it on.
Click Turn on enhanced security, pick the keys you want to allow (at least 2), click Continue to Verification, and confirm with one of those passkeys.
Register a second passkey on a different device before enabling this, and travel with it. With Enhanced Security on and one authorised passkey left at home, there is no email-code fallback and no way in.
Click Turn off enhanced security, confirm Turn off enhanced security? with Continue to Verification, then verify with one of your authorised passkeys. It needs that passkey check, so it cannot be undone by someone who has taken your inbox.
The security log
Open it from the Security logs row in the Security logs and blockchain card at the bottom of Sign-in & security. It lists each sign-in, sign-out and session eviction ("Signed out (new sign-in elsewhere)"), with the device, IP address and time. Worth a glance after any notification you did not expect.