Accounts and security
How your password is stored, and what to know during testing.
Open File → Team Create… and choose Create an account (username, email and password) or Log in.
How your details are kept
- Passwords are never stored. The server keeps only a salted PBKDF2-SHA256 hash of your password (100,000 iterations, with a random salt for each user).
- Login tokens are random, kept only as hashes on the server, and last 30 days. After that, log in again.
- Your email address is stored so that email verification can be added later without anyone needing a new account.
During testing
- There's no email verification yet.
- There's no password reset yet. Choose a password you'll remember, ideally in a password manager.
See the privacy notice for exactly what's stored and why.