Your security

Changing your password

Changing your password signs out your other sessions.

That is the important sentence, and it is exactly the behavior you want: if you are changing your password because you think somebody else has it, signing every other session out is the point.

It also means changing your password on your laptop signs you out on your phone. That is not a bug.

The minimum length is stated on the form. Steerd does not impose character-class rules, because length is what actually matters and rules mostly produce Passwort1!.

If you sign in with Google

You sign in with Google, so there's no password to change.

There is nothing to do here. Your account security is your Google account's security, including its two-factor setting, and that is where to strengthen it.

Changing your email

Also here rather than on your profile, because it changes what you sign in with.

Steerd confirms the change with your current address before it takes effect. So an attacker with a live session still cannot quietly move your account to an address they control without the old mailbox noticing.

What to do if you think an account is compromised

1. Change your password, which ends the other sessions.
2. Revoke API keys you do not recognize.
3. Revoke contacts sync passwords for devices you no longer have.
4. Check Connected apps under Integrations and revoke anything unfamiliar.
5. If you are an admin, read the audit log.

Those four credential types are independent. A password change alone does not revoke an API key, and that is the step people forget.