Sign in, recover access, and secure your account

Account security protects access to the plan, not just the password

Your YARCalc account can contain a detailed picture of household finances, so sign-in security deserves the same care as other sensitive online accounts. The Security area covers password changes, multifactor authentication, recovery, and active sessions. These controls protect access to YARCalc; they do not change a retirement plan or any account held at a financial institution.

Most people should use a unique password and enable an authenticator when it is available. You do not need to change settings repeatedly, but you should review them after a lost device, email change, suspicious sign-in, or concern that another person knows the password.

Set up recovery before you need it

Create an account with an email address you control and complete the verification link before continuing to Plan Setup. Replace a temporary password when prompted. A standard signed-in session expires after twelve hours; Remember me for 30 days can keep it active between visits, so do not use that option on a shared or public device.

Multifactor authentication adds a time-changing code from a compatible authenticator app. It reduces the harm of a stolen password, but it also makes recovery preparation important. Save recovery information securely and separately from the device that generates codes.

On a device you control, select Trust this browser when entering a valid authenticator code. Later sign-ins in that browser require your password but skip the code. Leave Remember me for 30 days unchecked if you want to enter your password at each new sign-in. Ordinary sign-out preserves browser trust.

Trust belongs to this account and browser profile while its saved cookie remains available. Restarting YARCalc does not remove browser trust. Clearing cookies, private browsing, or using another browser can require a code again; a browser update alone does not remove trust if the cookie survives. There is no scheduled thirty-day authenticator check. Do not trust a shared or public browser: someone with your password and that browser could sign in.

Repeated failed sign-ins are temporarily limited. If the account remains locked after the protection period, contact YARCalc support without sending a password, authenticator code, or recovery secret.

Change one access method at a time and verify it

New password strength evaluates only the new password you are typing. It does not read or grade your existing password, and it does not assess your authenticator or trusted browsers. The new password takes effect only after a successful password change.

If Create account rejects an entry, correct the reported error in the retained name, email address, or invite code. Re-enter both password fields; passwords are cleared after a rejected submission. Use at least ten characters and enter the same password twice. An invite code must match the email address it was issued to.

A sign-in link can return you to a page inside YARCalc. If its destination is invalid, sign-in opens your usual starting page. Use YARCalc navigation to open the page you wanted and update the bookmark. Signing in should keep you on the YARCalc website; check the address before entering more account information.

Use the password-reset email or an available recovery method when you cannot sign in. Recovery and verification links are single use and expire. If a link is old or has already been used, request a new one rather than forwarding it or trying to modify the address.

Resetting a password does not turn off your authenticator. If multifactor authentication is enabled, enter the current authenticator code after choosing the new password to finish signing in. If verification expires or you leave the page, sign in again with the new password and authenticator code; the recovery link has already been used. If you have lost access to the authenticator, contact YARCalc support for account verification.

If authenticator verification is already in progress, wait for it to finish before submitting another code. Each verification request allows five attempts within five minutes. After that, sign in again to start a new request. If you have several unfinished sign-in requests, finish one or wait up to five minutes before starting another. After changing or resetting your password, start a new sign-in with the new password; an earlier unfinished verification cannot restore access. If YARCalc temporarily limits sign-in attempts, wait for the displayed time; opening another tab or changing the page address does not reset the wait.

When YARCalc says a request could not be verified, no change was accepted. Reload YARCalc in the same tab and submit again. Open YARCalc directly rather than through a page embedded in another site. If the message continues in a current browser, contact support without sending passwords or authentication codes.

To enable multifactor authentication, scan or enter the setup information in the authenticator app and confirm a current code before leaving the page. To change a password, enter the required current or recovery information and choose a new unique password. A password change ends other signed-in sessions.

To replace your authenticator app, first disable the existing authenticator in Account Settings with your current password and current authenticator code. This signs you out on all devices. Sign in again and set up the new app. Complete setup within ten minutes from the same signed-in browser session that displayed the QR code. If you sign out or setup expires, start setup again. If the old authenticator is unavailable, contact YARCalc support for account verification.

Use Sign out all devices when a phone, computer, or remembered session may no longer be safe. Closing a browser does not necessarily revoke a remembered session.

In Account Settings, review Trusted browsers and choose Remove trust for a browser you no longer use. Removing trust requires a code at the next sign-in; it does not end an already signed-in session. Password changes or resets, authenticator changes, and Sign out all devices remove browser trust. Disabling or replacing an authenticator still requires the current password and authenticator code.

Confirm the new sign-in path before discarding the old one

After a password or authenticator change, sign in using the new method and verify that the Security page shows the intended status. Keep recovery information until that test succeeds. Review active-session controls after removing a device or changing credentials.

A successful security change should not alter the main plan, What-ifs, analyses, or balances. If planning data appears different, first confirm that you signed into the same account and selected the intended plan.

If you believe someone else accessed the account, change the password, revoke other sessions, review the sign-in email and multifactor status, and contact support with a nonsensitive description of the concern.

Never send access secrets as part of a support request

YARCalc support does not need your password, authenticator secret, current code, recovery code, brokerage login, or complete financial documents. Anyone asking you to send those items should be treated with caution.

These controls secure YARCalc access only. They do not secure your email account, authenticator device, password manager, brokerage accounts, or copies of information stored elsewhere.

Decline a request or cancel an issued invite

Decline rejects a pending invite request; Revoke cancels a code that has already been issued. Declined requests need no further action to prevent registration in Invite only mode. If the decision changes, a declined or revoked request can be approved and a new code sent.

Choose a password you can keep unique

Use at least ten characters and enter the same password in both password fields. Choose a unique password for YARCalc rather than reusing the password for your email or financial accounts. A password manager can help you keep it available without sharing it.

After a rejected registration, correct the reported entry and enter both password fields again. The other retained details do not mean the password was saved. An invitation also needs the email address to which it was issued.

Recover a forgotten password or a failed sign-in

On Sign in, choose Forgot password and request a reset for the email address used by the account. Open the latest reset email, choose a new password, and finish the sign-in steps. A used or expired link needs a new request. Check the email address and junk folder if the message does not arrive.

A password reset keeps an enabled authenticator in place. Have its current code ready. If the authenticator is lost, contact YARCalc support for account verification; changing the password cannot replace that verification. If sign-in is temporarily limited, wait for the displayed time before trying again.