Passwords and two-factor authentication

Most LeakTrace customer surfaces do not use passwords. The exceptions and the password policy are below.

Pages opened with an emailed code

Every business page (assessment dashboard, monitoring dashboard, reviewer read-only view) opens with its link and a one-time 6-digit code, emailed to an address already on the record. The link alone does not open the page. The code works for 10 minutes and once, and five wrong codes pause code entry for 15 minutes. There is no password to remember and none to leak.

Surfaces that still use a password

The legacy individual product (/dashboard/, /monitoring/, /account/ when accessed via Django auth) uses a username + password login. If you signed up before the business product launch, this applies to you.

Password policy

• At least 8 characters.
• When you change or reset a password, it is refused if it is a commonly used password, is all digits, or is too close to your name or email address.
• Stored only as a salted hash (PBKDF2 with SHA-256, the default of the Django framework we build on). We cannot read your password back.

Reset a password

Use the Forgot password link on the login page. We email a reset link to your registered address. The link works once, and for 3 days.

Two-step sign-in

An account that signs in with a password can turn on two-step sign-in with an authenticator app, at /accounts/mfa/. Business pages do not use it: they open with their link and a one-time code by email, as described above. That emailed code is one sign-in step. It is not two-factor authentication.