- The cookie holds an identifier and nothing else
- No role, no address, no permission is stored in the cookie: only an opaque identifier and its signature. That is what makes it possible to revoke a session remotely and instantly from Account > Security.
- Every sign-in is logged
- Date, truncated network, browser, outcome. A sign-in from an unknown device triggers a message. You can read that log at any time, failed attempts included.
- Attempts are rate-limited
- Five failures on one address block attempts for fifteen minutes. The limit also applies per network, to slow down distributed credential stuffing. A successful sign-in resets the counter.
- The second factor is real TOTP
- Six-digit codes, a 90-second window, and refusal to replay a code already used. Works with any RFC 6238 app: Aegis, Ente Auth, 1Password, Google Authenticator.
- We will never ask for your password
- Not by email, not by phone, not through a form sent in a private message. If someone asks, it is phishing: report it to the security address published on the Security page.