Signing in
Sign in with an email and password, with Google or Microsoft, or with a passkey — and add a second factor to protect the account.
Your account is how you reach your business’s records, so how you sign in matters. There are several ways in, and you can use more than one.
Create an account
Sign up with an email address and a password, and you create a business at the same time — your account is tied to that business from the start.
You have to confirm your email address before you get full access. That is what stops somebody signing up with an address they do not own and receiving mail meant for whoever does.
Sign in the way that suits you
Three ways in, all equally valid:
- Email and password.
- Google or Microsoft — if your business already runs on one of those, this is one fewer password to keep.
- A passkey — your face or your fingerprint. See Passkeys.
Add a second factor
Turn on two-factor authentication from your Security page and sign-in asks for a code from your authenticator app as well as your password.
It is worth doing. The records behind this login include your clients’ addresses, your pricing and your bank connections, and a password on its own is one leak away from all of it.
An owner can also require it across the business — see Keeping the account secure.
Reset a password you have forgotten
Forgot password on the sign-in page sends a reset link to your email address. The link works once and expires.
If you signed up with Google or Microsoft you have no password here to reset — sign in the same way you did before.
What happens to your password
Passwords are stored hashed, using a slow, salted algorithm designed for the purpose. Nobody at SMG Tools can read your password, and a copy of the database does not hand anybody your login.
This page describes Authentication. It is written from that feature’s record and covers what has shipped, never what is planned.