If you are having trouble signing in to BOXED, resetting your password, or using two-factor codes, this article walks through each situation and tells you exactly what to do next.
Quick summary
You sign in to BOXED either with the email address and password attached to your account, or with Google sign-in if that is how you registered. If the password is not working, reset it from the sign-in screen or under Settings. You can turn multi-factor authentication on or off yourself under Settings, then MFA. If you have lost your MFA device, or lost access to your account email, please ask to speak to a human and our team will look into it and verify ownership with you. A locked or frozen account is a separate situation with its own article.
Signing in
There are two ways into a BOXED account, and which applies depends on how the account was created.
Email and password. The standard route. Passwords are a minimum of 8 characters.
Google sign-in (OAuth). If you registered with Google, use the Google button rather than entering a password, because an account created this way does not have a separate BOXED password to type. If a password reset email never arrives and you cannot remember setting a password, Google sign-in is very often the explanation.
Before troubleshooting anything else, check the following:
You are using the right email. If you have more than one email address, make sure you are entering the one you signed up with. A password reset email only ever goes to the address actually attached to the account.
Caps lock and autofill. Saved browser passwords go stale after a reset. Try typing the password manually rather than letting your browser fill it.
The captcha completed. Registration is protected by a Cloudflare Turnstile captcha. If it fails to load, disable any script-blocking extension for the page, or try a different browser.
Your account is not restricted. If you see a message that your account is locked or frozen rather than a wrong-password error, that is a different situation. See why is my account locked or frozen.
Your region is supported. BOXED is not available at all in Michigan, Washington, Louisiana, or South Carolina. If sign-in works but actions are blocked afterwards, see regional availability and "action not permitted" errors.
Resetting your password
There are two paths, depending on whether you can currently get into your account.
If you are locked out: select Forgot password on the sign-in screen, enter your account email, and follow the link in the email we send. The link is single use, so if you request several resets, only the most recent link will work.
If you are already signed in: go to Settings, then Change Password, and set a new password there. This is the safer option if you suspect somebody else knows your password, because it takes effect immediately.
New passwords must be at least 8 characters. We would strongly suggest something longer and unique to BOXED, because password reuse is the single most common way accounts are compromised.
If the reset email has not arrived, check your spam and promotions folders, confirm you entered the exact address on your account, wait a few minutes, and request the email again. If your email provider filters aggressively, adding our sender address to your contacts before retrying usually helps. If you registered with Google, no reset email will ever arrive, because there is no BOXED password on the account to reset.
Two-factor and multi-factor authentication (MFA)
MFA adds a second step to sign-in, using a code from an authenticator app on your device. We strongly recommend turning it on if you hold items or gems in your account.
To turn MFA on or off: go to Settings, then MFA. You can enable it and disable it yourself at any time while you are signed in.
Save your backup information. When you set MFA up, store the recovery details your authenticator app gives you somewhere safe and offline. This is what saves you if you change or lose your phone.
Codes are time based. If your codes are being rejected, check that the clock on your phone is set to update automatically. A clock that has drifted by even a minute will generate codes that fail.
If you have lost access to your MFA device and have no backup codes, you cannot disable MFA yourself, because the entire point of the check is that only your device can pass it. What you can do is ask to speak to a human, and our team will look into it and guide you through the verification needed to regain access.
Your account email
The email address on a BOXED account is not something you can swap for a different address yourself from within Settings. Being unable to self-serve the change does not mean nothing can be done, and what to do depends on your situation.
If you still have access to your inbox but simply prefer another address, no action is needed for day to day use. Sign-in, password resets, and order notifications all continue to work through your existing address, and your public profile does not show your email to anyone.
If you have lost access to your email inbox entirely, please ask to speak to a human. Our team will look into it, verify that the account genuinely belongs to you, and advise on the options available for your specific case. Have as much account detail ready as you can, such as your username, roughly when you registered, and recent activity on the account, because that is what makes ownership verification straightforward.
If your email was compromised, secure the inbox first, then change your BOXED password from Settings and enable MFA, so that a future inbox breach does not put your account at risk. Consider also completing phone verification, since editing withdrawal methods requires it.
Do not create a second account to work around an email problem. BOXED operates one account per person, and a duplicate account can be restricted, which makes recovering the original harder rather than easier.
Usernames
Your username is what other members see on your profile, in binders, and in site chat. Usernames are 1 to 20 characters and may contain letters, numbers, and underscores. If a username you want is rejected, it is usually because it contains a character outside that set, such as a space, hyphen, or emoji.
Common questions
I did not get the password reset email. What should I do?
If you did not get the password reset email, check your spam and promotions folders, confirm that you entered the exact email address attached to your account, and then request the reset again, since only the most recent link stays valid. If you registered using Google sign-in, no reset email will arrive at all, because there is no separate BOXED password on that account. Use the Google button on the sign-in screen instead.
I lost access to my MFA device. How do I get back in?
If you have lost access to your MFA device and do not have backup codes, you will not be able to disable MFA on your own. Please ask to speak to a human and our team will look into it and take you through the verification needed to restore access to your account.
Can I change my account email address?
You cannot change your account email address yourself from within Settings. If you have lost access to that inbox, please ask to speak to a human and our team will look into it, verify that the account is yours, and confirm what options are available in your case. If you still have access to the inbox, everything on your account continues to work normally, and there is nothing you need to do.
How do I turn two-factor authentication on?
You can turn two-factor authentication on by signing in and going to Settings, then MFA. The same screen lets you disable it again at any time while you are signed in, so it is fully self-serve in both directions.
I signed up with Google. Do I have a password?
If you signed up with Google, your account does not have a separate BOXED password, and you sign in using the Google button on the sign-in screen. Password resets do not apply to accounts created this way, so if Google sign-in is failing, the issue is with your Google account rather than with BOXED.
My password works but I cannot use the site. Why?
If your password works but parts of the site are blocked, your account may be locked or frozen, or the action may not be available in your region. Note that BOXED is not available at all in Michigan, Washington, Louisiana, or South Carolina. See why is my account locked or frozen and regional availability and "action not permitted" errors.
How do I keep my account secure?
To keep your account secure, use a password of at least 8 characters that you do not reuse anywhere else, turn on MFA under Settings, and complete phone verification, which is required before withdrawal methods can be edited. Together those mean that somebody holding only your password cannot move anything out of your account.