Passwords and Sign-in Lockout

Password rules

New passwords (when you sign up, accept an invitation, change your password or reset it) must:

• be at least 12 characters long,
• contain at least three of: a lowercase letter, an uppercase letter, a number, a symbol,
• have no spaces.

If your password does not meet the rules, the form says which rule it breaks.

Sign-in lockout

After five wrong passwords in a row, sign-in to that account pauses for 15 minutes. The message says how long to wait. A correct sign-in or a completed password reset clears the count.

An unknown email address gets the same message as a wrong password, so the sign-in page cannot be used to find out which addresses have accounts.

If you are locked out and cannot wait, use Forgot your password? on the sign-in page to set a new password.

Messages

| Invalid credentials | The email or password is wrong, or the address has no account | Check both, or use Forgot your password? on the sign-in page | | Too many failed sign-in attempts. Try again in N minutes… | The account is paused | Wait, or reset your password | | Password must be at least 12 characters (and similar) | The new password breaks a rule | Choose a longer password with the required mix |

Two-step sign-in is optional. Turn it on in Settings → Security. After your password, the sign-in page asks for the 6-digit code from your authenticator app. If you have lost your phone, enter one of your recovery codes instead (each works once). It is not available to outside partners yet, and it is not required for your whole organisation.