Keeping your account secure

The security of your Overleaf account and your project data are important to you, and they're also important to us. Overleaf provides a number of features to keep you informed about any changes to your account. If you have any questions about suspicious activity on your account, please contact us.

Requests for sensitive account information

Employees of Overleaf will never ask you to provide your password or complete billing information to us via our support channels. If you receive such a request, it will not have come from us and is not legitimate. You can treat any such messages as phishing attempts.

Resetting your password

If you believe your Overleaf account password may have been compromised, or would like to change it for any other reason, there are two methods to change it.

1. If you know your current Overleaf password, you can change the password at your user settings page.
2. You can reset your password by entering your account's primary email address at our password reset page. If there's an Overleaf account with a matching primary email address, we'll send an email with instructions to reset your password. If you don't receive the password reset instructions within a few minutes, please check your spam/junk folders, as well as any filters you may have set up, for any messages from welcome@overleaf.com.
3. We recommend that you set (or reset) a strong password that is not shared with any other site. Using a free password manager is a good approach.

If you use another method for logging in to Overleaf, for example Institutional Login, "Log in with ORCID", or similar, you can manage your password through those services.

Checking for other active sessions on your account

You can view any other active sessions for your account by following the steps at How can I know whether there are other sessions open on my account.

Email notifications about changes to your account

We'll send you email notifications about certain changes to your account settings. Make sure that the primary email associated with your Overleaf account is up to date, accessible to you, and can receive emails from welcome@overleaf.com. To change add or update your email address, use the instructions at Changing email address associated with an account.

Here are some examples of changes to your account settings that result in an email notification:

• Changing your account's primary email address.
• Adding a secondary email address to your account.
• Linking your Overleaf account with a third-party service. (Examples: Google, ORCID, Dropbox, and GitHub.)
• Linking your Overleaf account with an institutional single sign-on provider (available if you're a member of selected institutions).
• Clearing your Overleaf account's active sessions.

If you receive an email notification for an account change that you don't recognise, please contact us right away so we can investigate. It's also good practice to reset your password and check for any active sessions if you are notified of activity that you do not recognise.

Your responsibilities

While Overleaf provides features to help you keep your account secure, you must use your Overleaf account in a secure way in order to keep your projects and personal identification safe. Overleaf's terms of service note that you are responsible for maintaining and protecting all of your stuff.

Do not share your Overleaf account

Every Overleaf user must have their own individual account.

Sharing an Overleaf account is not the correct way to collaborate on a project or to provide premium features to multiple users.

To collaborate with others on a document, use Overleaf's sharing options. If you are part of a team using Overleaf, each team member gets their own account. Team members' accounts might join a group subscription to gain access to premium features.

Take care using shared devices

If you are using a shared device in your home, lab, library, or other location, please make sure to sign out of your Overleaf account when you are done with your work.

Use a secure login method

Overleaf offers multiple login methods. If you are using the email and password based login method, you must use a strong password. We recommend using a password manager and setting up a unique password for your Overleaf account.

Overleaf also provides options to log in with Google or ORCID. For some types of subscriptions, Overleaf offers Single Sign-On (SSO) options.

Make sure you can access your primary email address

Important security notifications and password-reset links are sent to your primary email address. It is essential that your primary email address is always set to be one that you can access. If you are are leaving an institution or changing your email address, be sure to update the primary email address on your Overleaf account before you lose access to your current email address.

Allow emails from welcome@overleaf.com

As described above, you may receive important email notifications about your account. If you mark emails from welcome@overleaf.com as spam or junk, you may not receive important notifications about your Overleaf account. We ask that you be sure to check that these emails are not being sent to your spam or junk folder, and that you do not mark these as spam.