09 Oct Goodbye passwords. Goodbye MFA. Hello, one-tap sign-in.
From 17 October 2026 logging into Mnemonica will change face, making it faster to access and even more secure.
The password field and all multi-factor authentication steps and methods will be removed, without exception.
Instead, you will get a one-time magic link in your inbox.
Following that, you protect your account with a passkey: the way you unlock your device, by fingerprint, face or PIN. It takes a few seconds, and from then on signing in is one tap. If you like, you can also link your Google or Apple account, as a quicker alternative to the email link.
Nothing to remember, nothing to type, and nothing an attacker can steal from you.
On this page
- What goes away, and what replaces it
- How signing in will work
- The new security model: basic vs. strong
- Control your keys any time
- Adding another device
- What happens to your current credentials?
- What happens to Mnemonica apps?
- If you lose the phone, the laptop, or the account
- If your team shares one login
- Questions you may ask
What goes away, and what replaces it
Your password goes away, and so does every MFA method: the Mnemonica app prompt, authenticator apps, a second email address, SMS and PIN. All gone.
In their place, you’ll find the new sign-in dialogue box, which we’ll explain in detail below.
Signing in by QR code with the Mnemonica app stays, and gives a strong session. The app has to be set up again first: see “What happens to Mnemonica apps?” below.
How signing in will work
Signing in becomes a three-step flow, as illustrated below.
Step 1
Type your email. Open the link.
Type the email address you use for Mnemonica and we send you a link. It works once only, for 15 minutes, and only for you. Open the email and tap the link: a Mnemonica page opens and asks you to confirm. Press the button and you are in.
You are signed in on the device where you open the link, not the one where you asked for it. So open the email on the phone or computer you want to work on.
This is basic access. It opens your projects and lets you do whatever your role allows in them. The exceptions are the projects whose managers ask for a more secure sign-in, and the pages for managing a company: for those you need the next step.
Step 2
Protect your account to get strong.
Once you are in, Mnemonica offers to protect your account. First it asks one question: is this your personal computer?
Yes, only I use it. You create a passkey. A passkey is the way you unlock your device: fingerprint, face or PIN. It is kept by your device or by your password manager. If this computer cannot hold a passkey, Mnemonica has you install the Mnemonica app and scan a QR code with it instead.
No, others use it too. Nothing is saved on this computer. You scan a QR code with the Mnemonica app, or you use a security key.
Either way your session becomes strong immediately. Now Strong projects and your company pages open too.
You can choose Later. You stay in a basic session, and Strong projects stay closed until you come back to this step.
On the same screen you can link your Google or Apple account. That gives you a quicker way in next time, but it is a basic sign-in, like the email link: it does not make a session strong.
Step 3
After that, one tap and you’re in.
From then on the sign-in is one tap. Unlock your passkey the way you unlock your device, by fingerprint, face or PIN, and you are in your workspace with a strong status. Google and Apple are one tap too, and open a basic session. The email link stays below, for when you use a computer that does not know you.
On a computer that is not yours, the QR code is the better choice: scan it with the Mnemonica app and you get a strong session, and nothing of yours is saved on that machine.
The new security model: basic vs. strong
So far, content security in Mnemonica was actively provided by the account security. An account with active MFA is a stronger safeguard than without.
With the new model, the security is no longer related to the account security settings, but rather to the session.
As said above, a session is basic or strong depending on how you signed in. Which one you need is decided by the project: a project is either marked Strong or it is not.
Why? Because an email link just proves you can read a particular mailbox, and a Google or Apple sign-in just proves you can get into that account. How well that account is protected is decided by its owner’s settings, and Mnemonica cannot check them: that is a basic verification. A passkey, or the Mnemonica app on your phone, is a proof Mnemonica checks by itself, every time: that is a strong one.
| How you sign in | Session |
|---|---|
| Email link | Basic |
| Google or Apple | Basic |
| Passkey | Strong |
| Mnemonica app on your phone, with device unlock turned on | Strong |
| QR code approved with the Mnemonica app | Strong |
As it belongs to the session, strong is not permanent: if you sign in with an email link, Google or Apple tomorrow, you start in basic. However, when you open a Strong project, or anything else that requires a strong session, you will be asked to sign in with your passkey, or to approve with the Mnemonica app, and then you carry on. If you have no passkey yet, you can add one right there.
Strong projects
A manager can decide that a project’s material needs the more secure sign-in, and switch on “Strong session required” in its settings. That project is then Strong: it shows a lock icon, and it opens only to a strong session. That holds for everybody in it, from managers to guests, and for everything in it, watching included.
In a project that is not marked Strong, a basic session is enough for whatever your role allows, managers and editors included.
With a basic session you still see your Strong projects in the project list, with their lock, and you still receive their notifications. You are asked for your passkey when you open one.
Projects that required MFA until now are Strong from 17 October: in their settings the switch reads “Strong session required”. Every other project, and every new one, starts with the switch off. A manager can turn it on at any time; turning it off requires a strong session.
What a basic session and a strong session can each do in Mnemonica
| What you can do | Basic | Strong |
|---|---|---|
| Everything your role allows in projects not marked Strong | ✓ | ✓ |
| See your project list and notifications, Strong projects included | ✓ | ✓ |
| Reset all your strong methods, when you have lost them | ✓ | Not needed |
| Open a Strong project and do anything inside it | – | ✓ |
| Manage a Company: members, projects, ownership | – | ✓ |
| Remove one passkey or one device | – | ✓ |
| Add another passkey or device when you already have one | – | ✓ |
| Create an API key for a third-party tool | – | ✓ |
| Change your email address | – | ✓ |
The lock covers the whole project: there is no part of a Strong project that a basic session can use.
Control your keys any time
Every way in to your account is listed on your Security page: passkeys, linked Google and Apple accounts, and the devices running the Mnemonica app. If you change your mind about one of them, go there and remove it. You need a strong session to do that, and it takes effect immediately.
If you have no strong session left, because the device that held your passkey is gone, you use the reset described below.
We tell you when a Google or Apple account is linked to yours, and when a reset is requested.
Adding another device
Once your account has a strong method, every new one is authorised by a device that is already strong. Nobody can add a device to your account with your inbox alone.
| You have | You want to add | How |
|---|---|---|
| The Mnemonica app, strong | A computer | Scan the QR code on the sign-in page with the app. You are in a strong session: add a passkey from your Security page. |
| A computer, strong | The Mnemonica app | Your Security page shows a one-time code. Type it into the app. |
| A computer, strong | Another browser or computer | Your Security page shows a one-time code. Type it into the new browser, then save a passkey there. |
| The Mnemonica app, strong | Another phone or tablet | The app shows a one-time code. Type it into the app on the new device. |
The code works once and for a short time. The new device shows whose account it is before you confirm. Never give the code to anybody: Mnemonica will never ask you for it.
If you keep your passkeys in iCloud Keychain or Google Password Manager, a passkey you save on one device appears on your other devices by itself. You do not need to do anything.
What happens to your current credentials?
Your email address
Stays. It is still your username. You can change it on your preferences page; you need a strong session to do it.
Your password
Deleted on 17 October 2026. The encrypted data is erased.
Your MFA methods
Removed from your account. No codes, no authenticator app (you can delete the Mnemonica entry there), and no backup codes to keep safe. Nothing carries over: everybody sets up a strong method again, starting with the email link.
What happens to Mnemonica apps?
Mobile App
Update it to the latest version and sign in with an email link. The app then asks you to turn on device unlock: the way you unlock your phone, by fingerprint, face or PIN. Once it is on, the app is a strong method and the phone remembers you. If your account already has a strong method, the app asks instead for a one-time code, which your Security page shows in a strong session on the web. A phone with no fingerprint, no face unlock and no PIN stays basic.
Mnemonica Gate
Update it to the latest version, then pair it once: sign in to the web app with a strong session and start the pairing there. The web app shows a six-digit code, valid for two minutes; type it into Gate and you are done.
If you lose the phone, the laptop, or the account
No fear: your email address is the base of your account, and you can always use it to receive a sign-in link. Losing a passkey, a device, or access to your Google or Apple account cannot lock you out of Mnemonica. There is always a way back in.
If you still have another strong method
Sign in with it, open your Security page and remove the lost device. It takes effect immediately. Then add the new device as described in “Adding another device”.
If you have lost every strong method
- Sign in with an email link
You only need your inbox. You’ll get in a basic session. Google or Apple work too. - Ask for a reset
On your Security page, ask for a reset. Every passkey and every Mnemonica app on your account stops working at once, and any strong session ends. We send an email to your address, and a notification to every phone that had the app set up. - Wait 24 hours
For 24 hours your account is basic only. You work as usual in projects that are not marked Strong. Strong projects stay closed, and no new strong method can be added. - Get strong again
After 24 hours, protect your account again from scratch: a new passkey, or the Mnemonica app. It is active immediately.
A reset cannot be undone, and you can ask for one at most once every 7 days. It does not touch API keys: remove those yourself if you need to.
A passkey that stays on a lost or old device no longer opens Mnemonica, but we cannot erase it from there: delete it from the device or from your password manager when you can. The Mnemonica app clears its own key the next time it is opened.
If you receive a reset notice you did not ask for, somebody can read your inbox or get into your Google or Apple account. Secure that account at once, and write to support@mnemonica.com. The 24 hours are there to give you time to notice.
Today, losing the second factor of authentication means being locked out of your account, and having to submit a support ticket to prove your identity.
It is a good idea to keep two strong methods, for example a passkey on your laptop and the Mnemonica app on your phone. Then a lost phone means removing one device, not a reset and a day’s wait. The app has one more advantage: its notification is the fastest way to learn about a reset you did not ask for.
If your team shares one login
We know this happens, and we know why. Productions use shared inboxes like title_xyz_editing@gmail.com because notes, deliveries and schedules really do belong to the whole editorial team. That inbox is fine. It is even a good idea.
A Mnemonica account is different. It is not a mailbox. It is the name attached to every action on the material you trust us with: who viewed the cut, who downloaded it, who shared the link. When five people use one login, the record only says that someone did it, and that helps nobody on the day it matters.
Passwords and a shared PIN made it easy to ignore this.
From 17 October 2026 a shared login still gets in: anyone who reads the shared inbox can open the email link, and works in a basic session. What it cannot do is go further.
A passkey is personal by design: it belongs to one face, one finger, one device. So a shared login won’t be able to access Strong projects and the company pages.
What to do before the date: ask your workspace admin to split the shared login into one account per person. It takes a few minutes, and everyone keeps the same access they have now. Keep the shared inbox for what it does well. Tell us early and we will help you, so that nobody finds a Strong project closed on the day.
Questions you may ask
I’ve opened the sign-in page and there’s nowhere to type my password.
That is normal: the password field is gone. Type your email address and press continue; the magic link arrives in a few seconds. If you already set up a passkey, or linked Google or Apple, you will see those first instead.
What actually is a “magic link”?
A normal email with a button in it. Pressing the button opens a Mnemonica page, where you confirm and are signed in. It proves that you can read your inbox. A password reset already works this way; we now use it as the main way in. The link works once and expires after 15 minutes.
What if the email doesn’t arrive?
Check your spam folder, and check that you typed the address your account is registered with: for privacy the page says “check your inbox” either way, even when it does not know the address. Then ask for another link on the same screen. If it is still missing, your workspace admin can check the address we have for you. And once you add a passkey or link a provider, you will not need email to sign in at all.
I asked for a link on my computer and opened it on my phone. Nothing happened on the computer.
That is how it works: the session starts where the link is opened, so your phone is the one signed in. To sign in on the computer, open the email there, or use your passkey.
Isn’t a link less secure than a password plus a code?
It is more secure, for a simple reason: there is no secret that someone can trick you into typing on a fake website, and no code that an attacker can ask you to read out. A passkey is even stronger: it works only on the real Mnemonica, and the important part never leaves your device.
Why does Mnemonica ask whether this is my personal computer?
Because a passkey saved on a computer opens your account to whoever can unlock that computer. Answer “Yes” only if nobody else signs in to it with your account. If you answer “No”, nothing is saved there: you scan a QR code with the Mnemonica app, or use a security key, each time.
My computer has no fingerprint reader. Can I have a passkey?
Yes. A passkey also works with the Windows Hello PIN, with your Mac password, or from a password manager. If your computer or browser cannot hold one at all, use the Mnemonica app and its QR code.
Do I have to use a passkey?
No, it is never mandatory. In projects that are not marked Strong, an email link, Google or Apple is enough. For Strong projects and for company pages you need one strong method, and a passkey is the simplest. The other is the Mnemonica app: on your phone it is strong once device unlock is on, and on a computer you scan the QR code with it.
I can see a project in my list but it will not open.
It is marked Strong and you are in a basic session. Sign in with your passkey, or approve with the Mnemonica app, and it opens. If you have neither yet, add a passkey when Mnemonica offers it.
I sign in with Google or Apple. Why is my session only basic?
Google and Apple are a quick way in, and they save you the trip to your inbox. But they only tell us that someone signed in to that account, not how: a second step there is the account owner’s choice, and we cannot see whether it was used. So they count like an email link. Add a passkey once and you have both: one tap, and a strong session.
What if I can’t use a passkey?
Then use the Mnemonica app. Turn on device unlock in the app, the way you unlock your phone by fingerprint, face or PIN, and the app becomes a strong method. On a computer, scan the QR code on the sign-in page with it and you get a strong session. If that is not possible either, an email link always gets you in; you stay in a basic session until you add a strong method. And a passkey does not need Google or Apple: your laptop, your browser, a security key, or a password manager can hold one.
I received a notice that my strong methods were reset, but I did not ask for it.
Somebody who can read your inbox, or get into your Google or Apple account, asked for a reset. They did not get into your Strong projects: for 24 hours nobody can add a strong method. Use that time: secure your email and your Google or Apple account, and write to support@mnemonica.com.
I use an API key with a third-party tool. What changes?
You create API keys from a strong session, and each key is shown once, when you create it. A key counts as a strong method. A reset does not remove it, so if a key may have leaked, remove it from your Security page yourself.
I moved to a new Android phone and the app signed me in by itself. Why is my session basic?
Android restores your sign-in when you change phone, so you do not have to start again. Nobody confirmed anything on the new phone, though, so that session is basic. Turn on device unlock in the app, or enter a one-time code from a strong session, and it is strong.
How do I close my account, now that there is no password to confirm with?
Ask for it from your preferences, as before. We email you a six-digit code, valid for ten minutes; type it in the same screen to confirm.
I don’t have my phone with me at work.
You do not need it. A passkey can live on the computer you are using, in your password manager, or on a security key. Your phone is one option, not a requirement.
Mnemonica · authentication update