Passwords, 2FA and the mnemonic

Three settings decide whether your account survives a bad day. Get them right at registration and you rarely think about them again.

The password

Generate a long, random password in a local password manager and let the manager remember it. Do not reuse a password from anywhere. The manager also quietly protects you from phishing: it will not auto-fill your Zion password on a look-alike address, which is a useful second alarm.

PGP two-factor

Turn on PGP 2FA immediately. From then on, a stolen password is not enough to enter your account; an attacker also needs your private key, which never leaves your machine. This single setting defeats the most common account-takeover path. Setup is on the PGP page.

The recovery mnemonic

At registration the market issues a recovery phrase. Write it on paper and store it offline. It is the only way back into an account whose password is lost.

No genuine login or support agent will ever ask for your mnemonic. Anyone who does is trying to steal the account. The phrase restores access; it is never needed to sign in normally.

Last reviewed 2026-07-11.