Your Rentor account guards real money and real documents, so it's worth two minutes to lock it down properly. Everything here lives in the Security section — in your account hub and in your dashboard Settings.

Changing your password

Password changes go through an emailed reset link, so nobody can change it without access to your inbox:

1. In the Password card, choose Change password (or use Forgot password on the sign-in page).
2. Enter your email. If it matches a Rentor account, a reset link is sent.
3. Open the link and set your new password.

Two things to know about the link: it works once and it expires 30 minutes after it was sent. If it's expired, just request a fresh one. After a successful reset you'll see "Password updated. All your devices were signed out for safety" — every session everywhere is ended, so anyone who had your old password is out.

If you signed up with Google, you have no password yet — the card offers Set a password instead, so you can also sign in with email whenever you like. Your Google sign-in keeps working either way.

If your account has no email address (you signed up with just your phone), the code goes by SMS instead of the link: choose Change password or Set a password, enter the 6-digit code Rentor texts to your number, then the new password. The same texted code stands in for typing your email when you close the account, and your two-factor codes go to the phone rather than an inbox. On the sign-in page, Forgot password? works with your phone number or username too and texts a code the same way; see Creating your account & signing in.

Two-factor authentication (2FA)

Two-factor adds a second step at sign-in, so a stolen password alone isn't enough. You choose one of three:

• Authenticator app — recommended. Codes are generated on your phone and work offline, so a dead network or a full inbox never keeps you out of your own account.
• Text message — a code by SMS to the number on your account. Works without email, which matters if your inbox is something you only open on a borrowed laptop.
• Email one-time codes — a fresh code is emailed to you each sign-in.

Turning it on

1. In the Two-factor authentication card, pick Authenticator app, Text message or Email one-time codes.
2. For the authenticator: scan the QR code with your authenticator app. Can't scan? Use the manual key shown below it instead. For text or email, Rentor sends you a code straight away.
3. Enter the 6-digit code, then tap Turn on.
4. Save your backup codes. They're shown once, and only once. Each code works a single time if you ever lose your device — keep them somewhere safe, not in the same place as your phone.

The card then shows On · Authenticator, On · Text message or On · Email codes.

Backup codes — your way back in

Backup codes exist for the bad day: the phone stolen at a stage, the handset that fell in water, the SIM swapped after a lost line. Eight codes, each usable once, and each accepted anywhere Rentor asks for a two-factor code — signing in, turning 2FA off, or confirming a sensitive action.

Because they are shown once, write them down when you turn 2FA on. While two-factor is on, the Backup codes card tells you how many unused codes you have left, and warns you when you are down to the last two. Running low, or never wrote them down? Tap Generate new codes, confirm with a current code (or one of the backup codes you still have), and save the fresh set — the old codes stop working at once.

Turning it off

Tap Turn off two-factor, then enter a current code from your app, text or email — or one of your backup codes — to confirm. This stops anyone disabling your protection without your device.

On the phone app: two-factor is under More → Security. The app turns on the email code method and can turn two-factor off again; to use an authenticator app or text messages instead, set that up on the website — it then protects your sign-in on the phone too.

Extra-sensitive actions

Some actions ask for a fresh code even while you're signed in — sending money from the M-Pesa wallet, saving payout details, connecting your KRA credentials. That's deliberate: a code per action means an unattended laptop can't move your money.

Locking the app on your phone

A phone is something you put down in public places, so the Rentor app can lock itself behind Face ID, Touch ID or your fingerprint. Turn it on under More → Security → Unlock with … — it only appears if your phone already has a face or fingerprint enrolled, and Rentor runs the prompt once before switching it on, so a lock is never enabled on a device where it doesn't work.

What it does, and what it doesn't:

• The prompt appears when you open the app and after you've been away from it for a while. In ordinary use — flicking to WhatsApp and back — it doesn't nag you.
• It is a lock on the app, not a second password. Passing it decides whether the app carries on with the session it already has.
• A failed or cancelled prompt never locks you out of your account. The lock screen offers "Use my password instead", which signs you in the ordinary way.

Being signed out when you're away

Rentor ends an idle session after 30 minutes of doing nothing, on the web and on the phone. On the web a Still there? box counts down the last two minutes — tap Stay signed in and you carry on. The clock is about inactivity only: while you are clicking, typing or scrolling, it never runs out.

A phone with the app lock switched on is treated differently, because a locked phone is not a shared computer: the app stays signed in for up to 30 days and shows you the lock screen instead of throwing you out — you're one glance from being back in, rather than typing a password on a bus. Switch the app lock off and the 30-minute rule applies again.

Where you're signed in

The Where you're signed in card in the Security section lists every live session — Web browser, Rentor app, or Rentor app (locked device) — with when each was last used, and marks the one you are looking at as This device. Rentor deliberately keeps no location or IP address against a session, so the list tells you what is signed in, not where.

Signing out from the account menu ends the session on that device only — your other phone or laptop stays signed in, which is usually what you want.

To end the rest, tap Sign out everywhere. Every session except the one you are using stops working immediately — that is how you end the app on a phone you sold, or the browser at a cyber café you can't be sure you signed out of.

If you think someone actually has your password, change it as well (or use Forgot password if you can't remember it). A password change destroys every session on every device, including this one — you'll see "Password updated. All your devices were signed out for safety" and simply sign in again with the new password. It's worth doing even if you also turn on 2FA — 2FA protects the next sign-in, while sessions already open are only closed by signing them out.

On the phone app: the same list is under More → Security → Where you're signed in, with the same Sign out everywhere button.

Changing your phone number

Password-reset links and security codes are texted to the number on your account, so moving it takes a little proof. In the Phone number card — in your account hub and in dashboard Settings — type the new number and tap Change number. Rentor asks only for what your account owes: your password (or, if you sign in with Google, a code to the contact you already confirmed), then a code texted to the new handset, then your two-factor code if you use one. When it's done, the old number is told, in case it wasn't you.

A number can sit on only one Rentor account, so a number that is already in use elsewhere is refused.

Lost the old SIM and have no password? Tap Can't complete these steps? Request a change with admin help. Rentor still texts a code to the new number to prove it's yours, and then a member of the team reviews the move. You're notified either way.

Good habits

• Use a password you don't use anywhere else.
• Never share a one-time code with anyone — not even someone claiming to be Rentor support. Rentor will never ask you for one.
• Keep your email account itself secure; it's the key to password resets.
• Lost your phone? From any other device, tap Sign out everywhere, then change your password — together they end every session and lock the old one out.

On the phone app: two-factor, the biometric app lock, the list of signed-in devices and your password all live together under More → Security, and secure actions like wallet payments ask for the same two-factor code as the web.