Managing Your Carta Account: Email, Password, and 2FA

Most account issues come down to one of three things: an invitation that was never opened, confusion about which email controls access, or a lost 2FA device. Here's how each works.

If an employee hasn't registered yet

Employees can't reset a password or reset 2FA on an account that doesn't exist yet. This comes up often: an employee tries to "reset their password" when they never actually completed registration in the first place. If someone can't find their account, resend the original invitation from their stakeholder record rather than troubleshooting a password reset.

Losing access to a work email doesn't mean losing Carta access

Employees sometimes assume that losing access to the email address tied to their account (for example, a work email deactivated after leaving a job) locks them out of Carta entirely. It doesn't. As long as they still know their login email and password, they can log in and update their email directly from their account settings.

Updating an email or resetting 2FA

If an employee still knows their login email and password but has lost their 2FA device, they need a 2FA reset, not a full account recovery. Account Recovery is for a different situation: losing access to the primary email itself, and not knowing the password. One constraint to know either way: each email address can only be tied to one Carta account, so an employee can't add an email that's already registered elsewhere.

Why it matters

Most of these situations look like a bigger problem than they are, and picking the wrong recovery path just adds delay. An employee who can't log in at all usually just needs their invitation resent. One who's lost their 2FA device but still has email and password access needs a 2FA reset. Account Recovery is specifically for losing access to the primary email.

If an employee is stuck

Direct them to Carta Support for account recovery, 2FA resets, or email updates. Company admins can check whether an invitation was ever sent or resend one directly from the stakeholder record.