Password, sessions and login lockouts
Written by Moris Nakri
Updated September 15, 2026
Sessions last 14 days in a secure cookie; changing your password or signing out other devices invalidates every other session at once.
Resetting a forgotten password
- 01Open /forgot-password and submit your account email.
- 02Open the reset link from the email. It is valid for one hour.
- 03Choose a new password. All existing sessions are signed out.
For privacy the response is identical whether or not the address has an account, so no reply on screen does not mean the address is wrong.
Too many failed attempts
After five failed logins the account is locked briefly and the wait doubles with each further failure, from 30 seconds up to 15 minutes. The error tells you how long to wait. The lock clears on its own — a successful login after the wait resets the counter.
Signing out other devices
Settings has a “sign out other devices” action. It bumps your token version, which immediately invalidates every session cookie except the one you are using. Changing your password, resetting it or confirming an email change does the same thing.
Sessions are stored in an httpOnly cookie that lasts 14 days. Clearing browser cookies signs you out of this device only.