Sign-in methods
Six ways to prove who you are, from the classic password to phishing-proof passkeys. People can mix and match. The sign-in page remembers the last method used on each device and highlights it.
At a glance
| Method | Best for | Notes |
|---|---|---|
| Email + password | Everyone | 10+ characters, checked against known data breaches |
| Email code | Occasional users, no password to remember | 6-digit code, valid 10 minutes |
| Teams on Google Workspace | Enabled when Google keys are configured | |
| Passkey | Daily users on their own devices | Fingerprint, face or device PIN. Phishing-proof |
| PIN | Shared devices: POS, reception, attendance tablets | 4–6 digits, opt-in, locks after 5 misses |
| Two-factor (TOTP) | Admins and owners | Adds an authenticator code after the password |
Email and password
New accounts must verify their email with a 6-digit code before signing in. Passwords need at least 10 characters and are rejected if they appear in the Have I Been Pwned breach corpus. Only a k-anonymous hash prefix is sent, never the password.
Forgotten passwords are reset with an emailed code. Resetting a password signs the person out of every other device.
Email one-time codes
Choose Email code on the sign-in page, enter an email address, then type the 6-digit code. Codes are stored hashed, expire after 10 minutes and allow 5 attempts. Sending is limited to 5 requests per minute.
Email codes can also create an account: if no account exists yet, verifying the code creates one with a verified email.
Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET (see Deployment)
and a Continue with Google button appears. If a Google address matches an existing account,
the two are linked automatically. People can connect or disconnect Google under
Security → Linked accounts.
Passkeys
Passkeys replace passwords with the device's own lock (Windows Hello, Touch ID, Android screen lock). Add them under Security → Passkeys. Once added:
- the sign-in page offers them in the browser's autofill menu, and
- Sign in with a passkey works without typing an email.
A passkey created on accounts.webrizen.com only works there. Choose your final domain
before users start registering passkeys.
Device PIN
A PIN gives staff a fast way in on shared devices without exposing their main password.
- It's opt-in: people set it under Security → Sign-in PIN after signing in another way.
- 4–6 digits. Repeated (
0000) and sequential (1234,4321) PINs are rejected. - Stored with the same slow hashing as passwords (scrypt).
- 5 wrong attempts lock PIN sign-in for 15 minutes, and requests are rate-limited per IP.
- PIN sign-in is refused when two-factor is on, so a PIN can never bypass 2FA.
Two-factor authentication
Turn it on under Security → Two-factor authentication, scan the QR code with any authenticator app (Google Authenticator, Microsoft Authenticator, 1Password…), then save the backup codes.
After that, password sign-in asks for a 6-digit code. People can tick Trust this device to skip the code on that device for a while. Five wrong codes lock two-factor verification for 15 minutes.
Encourage owners and admins to enable two-factor. They can change roles and invite people, which makes their accounts the most valuable ones in any organization.