Overview
Uphold authenticates users using email/password credentials combined with optional two-factor authentication (2FA). The platform uses secure session tokens to keep your session active while maintaining safeguards like device recognition and session expiry. Treat sign-in as a security gate: each step you take to harden it reduces the chance of unauthorized access to funds and identity data.
Why secure sign-in matters
Your Uphold account can hold fiat balances, crypto, and linked payment methods. A compromised sign-in means potential financial loss and identity exposure — so review your sign-in setup periodically and follow the principle of least privilege for connected apps.
Login Steps (web & mobile)
- Open the official Uphold app or website. Verify the domain and SSL padlock for the web experience.
- Enter your registered email and password. Ensure Caps Lock is off and paste only from your password manager if used.
- Complete 2FA if enabled. Provide the TOTP code from your authenticator or confirm via your registered device.
- Confirm device prompts. Review any device verification emails or on-screen messages before proceeding.
Prefer authenticator apps (TOTP) over SMS for stronger protection against SIM attacks.
Revoke sessions you don't recognize from account settings and sign out when using shared devices.
Security Practices
- Unique passwords: Use a password manager to store long, unique passwords for Uphold.
- Two-factor authentication: Enable TOTP/Authenticator and keep backup codes offline.
- Email hygiene: Ensure your recovery email is secure; attackers often target email first.
- Device health: Keep your OS and browser updated to reduce exploit risk.
Troubleshooting common sign-in problems
If you run into sign-in issues, work methodically — try the simple fixes first, then escalate with evidence:
- Forgotten password: Use the "Forgot password" flow; check spam or promotions folders for the reset email.
- 2FA not working: Sync your device time (authenticator codes depend on accurate clock time) or use backup codes saved during setup.
- Account locked or suspicious activity: Revoke sessions, change your password, and contact official support with account details and timestamps.
Recovery & verification
If automated recovery fails, support may ask for identity verification. Provide requested documents securely — never share your password or authenticator codes with anyone who contacts you. Uphold support will not request your password or secret keys via email or chat.
FAQ
What happens if I lose my 2FA device?
If you lose access to your authenticator, use backup codes saved during setup. If no backups exist, contact Uphold support and be prepared for identity verification steps.
Can Uphold access my funds?
Only you control your sign-in credentials. Uphold operates the custodial platform; protect your account credentials and use 2FA — support cannot move funds without account access.
How do I check active sessions?
Visit account security or session settings in your Uphold profile to see logged-in devices and revoke any session remotely.