Changing the email address on your account

Change it from your settings. We send a confirmation link to the new address, and the change happens when you follow that link — not before, so a typo cannot lock you out.

We also email the address you already have, telling it that the change was asked for and giving it a link to cancel. That notice is the point of the whole design: if somebody else is in your account, the address they are trying to move it to is the first thing you need to know about, and you need to hear it at the address you still control.

Confirming the change signs you out everywhere. Changing the address on an account is exactly what somebody who has stolen a session does first, so everybody signed in anywhere has to sign in again at the new address.

The link expires. If it does, ask again from settings.

An address that already has an account, and an address that once had an account which has since been deleted, are both refused — and the form deliberately does not tell you which, because that would turn it into a way of testing whether a given person has an account here. Addresses are never reused after deletion, because a new account would inherit the old one's mail.

Security notices like this one are sent whatever your email preferences say. Unsubscribing from the digest never stops us telling you that something changed about your account.