Temporary password and password requirements

When you receive a temporary password

When someone else creates the account (a company owner or administrator adding a team member or a client of the firm, or staff in the platform support panel), the system generates a temporary password. It shows it only to the person creating the account, once, together with a "Copy password" button. Pass it to the new person through a secure channel, e.g. in person or by phone. The email sent to them contains the login address and the expiry date, but never the password itself.

• The password has 16 characters from a readable alphabet (without easily confused characters such as 0, O, 1, l, I).
• We store only its secure hash in the database, so it cannot be read again.
• It is valid for 72 hours. After that, sign-in is rejected with the message "Temporary password has expired".
• Self-registration of a company does not use a temporary password: you choose your own password straight away.

First sign-in step by step

1. Go to the sign-in page and enter your email address and the temporary password.
2. The "Set your own password" screen opens. Nothing else works until you set a password: every other page redirects back to this screen, and if needed you can choose "Cancel and sign out".
3. Enter "New password" and "Repeat password". The "Show password" button lets you check what you typed.
4. When all requirements have green ticks, click "Save password and sign in". The temporary password stops working and you enter the app.

If the account has two-factor authentication (2FA) enabled, the code from the app is required even before the password-setting screen. In the administrator panel, 2FA setup follows once the password is set.

Password requirements

• At least 12 characters (we recommend 14 or more).
• A lowercase letter, an uppercase letter, a digit and a special character (a space also counts as a special character).
• It must not be a common password or a dictionary word, including with digits at the end or letters swapped for digits (e.g. "P@ssw0rd2024!").
• The password must not contain your email address (or the part before the @), your first name or your company name.
• No repetitions or sequences, such as aaaa, 1234, abcd, qwerty.
• Different from the temporary password and from your last 5 passwords.

The same requirements apply to registration, password reset, accepting an invitation, changing your password under "Account and security" and in the administrator panel. The "Password strength" meter rates a password from "Very weak" to "Very strong" based on length, character variety and penalties for patterns. A password that does not meet the requirements will not get a rating higher than "Weak". The best option is a long, random password stored in a password manager.

Expired or not working: new temporary password

On the sign-in screen, choose "Request a new temporary password". The person who created your account will receive a message, and your account in the team list will show a "Requesting a new password" tag. They (the company owner or administrator) then click "New temporary password" and pass you a fresh password. Each new temporary password invalidates the previous one.

Changing your password in Settings

Go to Settings, "Account and security", the "Password" tab: enter your current password and the new one twice. After the change we will sign you out of all devices, and you sign in with the new password.

Forced password change by platform support

In justified cases (e.g. after an incident), platform support can force a password change for a selected user or for all members of an organisation. At the next sign-in with the current password, the "Set your own password" screen appears, and the new password must differ from the current one. Existing accounts without such an order are not forced to do anything.