Signing in, password reset and two-factor authentication (2FA)

Enabling 2FA

1. Go to "Account and security" (user menu or Settings) and on the "Two-factor authentication (2FA)" tab click "Enable 2FA".
2. Click "Start setup". You will see a QR code and a key to enter manually ("Copy key"). We show the key only once.
3. Scan the code with an authenticator app (e.g. Google Authenticator, Microsoft Authenticator or 2FAS).
4. Enter the 6-digit "Code from the app" and click "Enable 2FA".

From now on, signing in additionally requires the "2FA code" field. To disable 2FA, click "Disable 2FA" and enter your password and the current code.

Lockout after incorrect codes

Five incorrect 2FA codes block sign-in for 15 minutes; during that time even a correct code is rejected. In addition, registration, sign-in and other authentication routes have a limit of 10 requests per minute from a single IP address.

Password reset

1. On the sign-in page, choose "Forgot your password?", enter your "Email address" and click "Send link". The response is always the same, whether or not the account exists.
2. The link from the email is valid for 1 hour and works once; a new link invalidates the previous one.
3. Set a "New password" that meets the requirements (the checklist with ticks and the strength meter show live what still needs fixing) and repeat it.

After a password change, all your sessions on all devices are signed out and your email address is marked as verified. A password reset does not disable 2FA.

Email address verification

After registration we send a single-use link valid for 3 days. An invitation accepted via the link and a password reset verify the address automatically.

Sessions

The access token lives for 15 minutes and is renewed with a refresh token valid for 7 days. Reusing a used token invalidates the whole token family. "Sign out" ends the session on the current device. Signing out of all devices happens after a password reset.