Account

Updated Oct 15, 2026

Password and sign-in email

Your password needs at least 8 characters, with upper and lower case letters and a number. A password found in a known data breach can't be used. The same rules apply when you create your account, reset your password, or change it under Settings > Security.

Changing or resetting your password signs you out of every other browser and every phone signed in to the Whispertrades app. A password change keeps the API tokens you made on the API page; a reset from the sign-in page revokes them, so create new ones afterwards.

To change your sign-in email, open Settings > Profile, enter the new address and your current password, then open the link we email to the new address within 60 minutes while signed in. We let your previous address know once it changes.

Security emails

We email you, and send a push to any phone with notifications on, when a new browser or the app signs in to your account, when your password, two-factor authentication, recovery codes, passkeys or sign-in email change, and when signing in is paused. These can't be turned off. If one describes something you didn't do, reset your password from the sign-in page and contact support.

Signed-in browsers and phones

Settings > Security lists every browser that used your account in the last 30 days and every phone signed in to the app. If you see one you don't recognize, use Sign out of other browsers or Sign out of the app everywhere, then change your password.

Too many sign-in attempts

After 30 wrong passwords for one email address within an hour, password sign-in to that address pauses for an hour, on the website and in the app. After the right password and then 10 wrong two-factor codes within an hour, two-factor sign-in pauses the same way. A password reset lifts both pauses, a passkey still signs in, and support can lift a pause. If you get a two-factor pause you didn't cause, someone has your password, so reset it right away.