Knowledge Base

Overview

To use Truestamp as a signed-in user you first prove who you are. There are three ways to sign in: with your email and password, with a one-time magic link sent to your email, or with a passkey you approve on your device. Password and magic-link sign-ins identify you by your email address, and if you have turned on two-factor authentication they add a second step where you enter a time-based code from your authenticator app before you are let in. A passkey sign-in is complete in one step and skips that second step.

Once you have proven your identity, Truestamp establishes a session: a signed record in your browser that keeps you signed in on later page loads so you do not have to re-authenticate on every request. You stay signed in for that browser until you sign out, until the session expires, or until you change your password (which signs you out everywhere).

This concept covers the interactive sign-in flow that a person uses in a browser. Programmatic access for scripts and applications uses separate credentials (API keys and OAuth), which are covered elsewhere and are not part of the browser sign-in described here.

Registering an account

You create an account by registering with your email address and a password. A password must be at least 8 characters (and at most 128). After you register, Truestamp sends a confirmation email to that address. The link in that email does not confirm you by itself: it opens a Truestamp page where you press a button to finish. That deliberate extra step means a mail scanner or link preview that fetches the URL cannot silently spend the link on your behalf. What happens around registration, from the personal team you receive to eventual account deletion, is covered in the life of a Truestamp account. A confirmation link is good for one day and expires if you do not use it; if a link expires you can request a fresh one from your profile. Resending has its own limit, described under sending limits below, and registration itself is limited per network address so accounts cannot be minted in bulk from one place.

The email address you register is your identity for every sign-in method: your password, your magic link, and your second factor are all keyed to it. Email addresses are treated case-insensitively, so it does not matter whether you type your address in uppercase or lowercase when you sign in.

Signing in with email and password

The default way to sign in is to enter your email and password. If they match an account, you are signed in (or advanced to the second-factor step if you have two-factor authentication enabled).

Password sign-in is throttled to slow down guessing attacks. Attempts are counted per email address: after 10 attempts against the same address within a 5-minute window, further attempts against that address are temporarily rejected until the window passes. Every attempt counts toward the limit, whether the password was right or wrong, and the counter is keyed to the address being signed in to, so one attacker hammering one account cannot lock other people out. Ten attempts in five minutes is far above normal human use but makes automated online password guessing impractical.

Sign-in throttling is a limit on how fast credentials can be tried, not a permanent lockout. It resets on its own once the window passes.

Signing in with a magic link

You can also sign in without typing a password. You enter your email address and Truestamp sends you a one-time sign-in link. Opening the link brings you to a Truestamp page where you press a button to complete the sign-in, the same deliberate extra step that protects the confirmation link.

The magic link is single-purpose and time-limited: it works once, for 10 minutes after it is issued, and only for the address it was sent to. If a magic link is used to sign in and no account yet exists for that email, an account is created for you on the spot, so a magic link doubles as a lightweight way to get started. As with a password sign-in, if you have two-factor authentication enabled you still complete the second-factor step after the link signs you in.

Signing in with a passkey

The third way to sign in is with a passkey: a phishing-resistant credential you approve on your device with Touch ID, Face ID, Windows Hello, a device PIN, or a hardware security key. The sign-in page offers a “Sign in with Passkey” button; your browser shows the passkeys it holds for Truestamp, you pick one, and your approval completes the sign-in in one step.

A passkey replaces the password, not just the typing: there is no password step and no two-factor code step, because the passkey already proves possession of your device. Passkeys cannot register a new account, though. You establish an account with a password or magic link first and then add a passkey from your profile; registration, naming, and removal are covered in passkeys.

Two-factor authentication (TOTP)

You can add a second layer of protection by enabling two-factor authentication (2FA) with a time-based one-time password (TOTP) authenticator app such as Google Authenticator, 1Password, or Authy. Once enabled, signing in takes two steps: first your password or magic link, then a 6-digit code from your authenticator app.

Two-factor is a second factor only. It never replaces your password or magic link; it is an extra check layered on top. During setup, Truestamp shows a QR code you scan with your authenticator app to share a secret, and you confirm the pairing by entering a current code. To account for small clock differences between your phone and Truestamp, a code from the immediately preceding time step is also accepted, so a code that just rolled over still works.

The code-entry steps are throttled the same way passwords are: you may enter at most 3 codes per 5-minute window, counted per account, before further attempts are temporarily rejected. This makes guessing a 6-digit code within its short validity window impractical.

Enabling two-factor changes a security-relevant property of your account: after you enter your password or use your magic link, you are not fully signed in until you also pass the second-factor step. Truestamp re-checks this on every page of the signed-in application, so a half-completed sign-in cannot reach your data by navigating away from the code-entry screen. You can turn two-factor off again from your profile; doing so also discards your recovery codes, since they exist only to back up the second factor.

Recovery codes

When you enable two-factor authentication you are also given a set of single-use recovery codes. Each is a random code you save somewhere safe (a password manager is ideal). If you ever lose access to your authenticator app, you can use one of these codes in place of a TOTP code to complete the second-factor step and get back into your account.

Entering a recovery code is throttled like a TOTP code: only a small number of attempts are accepted per account within a short window before further attempts are temporarily rejected. Recovery codes are long and random, so guessing one was already impractical; the throttle stops an attacker from spending your account’s resources trying.

Recovery codes are single-use: each code works exactly once and is then spent. You are issued a batch of them, and you can regenerate a fresh batch at any time from the “Manage recovery codes” link in your profile, which replaces (invalidates) the previous batch entirely. You redeem one from the “use a recovery code” option on the second-factor screen. Because recovery codes exist only to back up two-factor sign-in, both of those affordances appear only while two-factor is enabled, and turning two-factor off removes the codes.

Limits on the emails Truestamp sends you

Confirmation, magic-link and password-reset emails are all requested by typing an address into a form, which anyone can do. Truestamp therefore limits how often those emails are sent, in three ways at once:

• Per address. Only a few of these emails go to the same address within an hour, counted across all three kinds together. Your address is never stored in the counter as readable text; it is reduced to an unreadable fingerprint first, and adding a +tag to it does not create a fresh allowance.
• Per network address. A larger allowance bounds how many of these emails any one network address, or one IPv6 network block, can trigger in an hour.
• Across Truestamp. A high fleet-wide ceiling protects our sending reputation. It is set far above any legitimate volume, so it cannot be used to block other people’s resets.

When a request is refused, Truestamp shows you the same message an accepted request does and simply sends no email. That is deliberate: a different message would tell a stranger whether an address has an account here. If an expected email does not arrive, wait a while and ask again.

The trade-off is worth knowing. Someone who knows your address can, by repeatedly requesting resets for it, delay the delivery of your reset or magic-link email for roughly an hour at a time. They learn nothing and change nothing about your account, and password sign-in and passkey sign-in both keep working throughout, so the practical effect is limited to that one route back in.

Your session

After you finish sign-in (including the second-factor step, if any), Truestamp gives your browser a signed session so you stay signed in across page loads without re-entering credentials. The session is cryptographically signed by Truestamp, so it cannot be forged or tampered with.

The password sign-in form also offers a “Remember me” checkbox. Left unchecked, your session lasts for that browsing session. Ticked, Truestamp additionally gives your browser a separate remembered-device credential good for up to 30 days, so closing the browser does not sign you out and Truestamp restores your session on your next visit. Tick it only on a device that is yours alone.

Two things end a session deliberately:

• Signing out ends the current session immediately.
• Changing your password signs you out of every session, everywhere, not just the browser where you changed it, and including any device you asked Truestamp to remember. This is a safety feature: if you change your password because you suspect someone else had access, that act evicts them.

If you forget your password, you request a password reset from the sign-in page. Truestamp emails you a reset link that is good for 10 minutes; following it lets you set a new password. As above, completing a reset signs out any existing sessions, remembered devices included.

What this protects against

Truestamp’s sign-in design defends against the common ways accounts are attacked:

• Online password guessing is throttled per email address, so an attacker cannot rapidly try many passwords against your account. Every attempt counts toward the limit, right or wrong.
• A stolen or reused password alone is not enough when you have two-factor enabled, because the attacker would also need a live code from your authenticator app.
• Second-factor code guessing is throttled to a few attempts per window, so brute-forcing the short-lived 6-digit code is impractical.
• A half-finished sign-in cannot reach your data: with two-factor enabled, you must pass the second-factor step before any page of the signed-in application will load.
• Emailed links cannot be spent by a machine: a confirmation or magic link needs a click on the Truestamp page it opens, so a mail scanner that fetches the URL does not consume it.
• A suspected compromise can be shut down by changing your password, which ends every active session at once, remembered devices included.
• Recovery codes are single-use, so a leaked one cannot be replayed, they are throttled like second-factor codes, and you can rotate the whole batch whenever you want.
• Emailed links cannot be requested in bulk: confirmation, magic-link and password-reset sends are limited per address, per network address and across Truestamp, so neither your inbox nor our sending reputation can be used as a weapon.

Limitations

Truestamp secures the account you use to submit data and manage your work; it is distinct from the cryptographic proofs Truestamp produces. Anyone can verify a proof without signing in at all, so account authentication is about who may create and manage data in Truestamp, not about who may check a proof.

Two-factor authentication is optional. If you do not enable it, your account is protected by your password (or magic link) and the sign-in throttling alone; enabling two-factor is strongly recommended for meaningful protection against a stolen password. Recovery codes exist only while two-factor is enabled, and they are your responsibility to store safely, because losing both your authenticator app and your recovery codes can lock you out of your own account. If you are locked out, see support and contact channels.