Overview

To use Truestamp as a signed-in user you first prove who you are. There are three ways to sign in: with your email and password, with a one-time magic link sent to your email, or with a passkey you approve on your device. Password and magic-link sign-ins identify you by your email address, and if you have turned on two-factor authentication they add a second step where you enter a time-based code from your authenticator app before you are let in. A passkey sign-in is complete in one step and skips that second step.

Once you have proven your identity, Truestamp establishes a session: a signed record in your browser that keeps you signed in on later page loads so you do not have to re-authenticate on every request. You stay signed in for that browser until you sign out, until the session expires, or until you change your password (which signs you out everywhere).

This concept covers the interactive sign-in flow that a person uses in a browser. Programmatic access for scripts and applications uses separate credentials (API keys and OAuth), which are covered elsewhere and are not part of the browser sign-in described here.

Registering an account

You create an account by registering with your email address and a password. A password must be at least 8 characters (and at most 128). After you register, Truestamp sends a confirmation email to that address; clicking the link in that email confirms your address. What happens around registration, from the personal team you receive to eventual account deletion, is covered in the life of a Truestamp account. Confirmation links are time-limited and expire if you do not use them; if a link expires you can request a fresh one from your profile.

The email address you register is your identity for every sign-in method: your password, your magic link, and your second factor are all keyed to it. Email addresses are treated case-insensitively, so it does not matter whether you type your address in uppercase or lowercase when you sign in.

Signing in with email and password

The default way to sign in is to enter your email and password. If they match an account, you are signed in (or advanced to the second-factor step if you have two-factor authentication enabled).

Password sign-in is throttled to slow down guessing attacks. Attempts are counted per email address: after 10 attempts against the same address within a 5-minute window, further attempts against that address are temporarily rejected until the window passes. Every attempt counts toward the limit, whether the password was right or wrong, and the counter is keyed to the address being signed in to, so one attacker hammering one account cannot lock other people out. Ten attempts in five minutes is far above normal human use but makes automated online password guessing impractical.

Sign-in throttling is a limit on how fast credentials can be tried, not a permanent lockout. It resets on its own once the window passes.

Signing in with a magic link

You can also sign in without typing a password. You enter your email address and Truestamp sends you a one-time sign-in link. Clicking the link signs you in.

The magic link is single-purpose and time-limited: it works once, for a short period after it is issued, and only for the address it was sent to. If a magic link is used to sign in and no account yet exists for that email, an account is created for you on the spot, so a magic link doubles as a lightweight way to get started. As with a password sign-in, if you have two-factor authentication enabled you still complete the second-factor step after the link signs you in.

Signing in with a passkey

The third way to sign in is with a passkey: a phishing-resistant credential you approve on your device with Touch ID, Face ID, Windows Hello, a device PIN, or a hardware security key. The sign-in page offers a “Sign in with Passkey” button; your browser shows the passkeys it holds for Truestamp, you pick one, and your approval completes the sign-in in one step.

A passkey replaces the password, not just the typing: there is no password step and no two-factor code step, because the passkey already proves possession of your device. Passkeys cannot register a new account, though. You establish an account with a password or magic link first and then add a passkey from your profile; registration, naming, and removal are covered in passkeys.

Two-factor authentication (TOTP)

You can add a second layer of protection by enabling two-factor authentication (2FA) with a time-based one-time password (TOTP) authenticator app such as Google Authenticator, 1Password, or Authy. Once enabled, signing in takes two steps: first your password or magic link, then a 6-digit code from your authenticator app.

Two-factor is a second factor only. It never replaces your password or magic link; it is an extra check layered on top. During setup, Truestamp shows a QR code you scan with your authenticator app to share a secret, and you confirm the pairing by entering a current code. To account for small clock differences between your phone and Truestamp, a code from the immediately preceding time step is also accepted, so a code that just rolled over still works.

The code-entry steps are throttled the same way passwords are: you may enter at most 3 codes per 5-minute window, counted per account, before further attempts are temporarily rejected. This makes guessing a 6-digit code within its short validity window impractical.

Enabling two-factor changes a security-relevant property of your account: after you enter your password or use your magic link, you are not fully signed in until you also pass the second-factor step. Truestamp enforces this on every protected page, so a half-completed sign-in cannot reach your data by navigating away from the code-entry screen. You can turn two-factor off again from your profile; doing so also discards your recovery codes, since they exist only to back up the second factor.

Recovery codes

When you enable two-factor authentication you are also given a set of single-use recovery codes. Each is a random code you save somewhere safe (a password manager is ideal). If you ever lose access to your authenticator app, you can use one of these codes in place of a TOTP code to complete the second-factor step and get back into your account.

Recovery codes are single-use: each code works exactly once and is then spent. You are issued a batch of them, and you can regenerate a fresh batch at any time from your account, which replaces (invalidates) the previous batch entirely. Because recovery codes exist only to back up two-factor sign-in, they are reachable only from the “use a recovery code” option on the second-factor screen, and turning two-factor off removes them.

Your session

After you finish sign-in (including the second-factor step, if any), Truestamp gives your browser a signed session so you stay signed in across page loads without re-entering credentials. The session is cryptographically signed by Truestamp, so it cannot be forged or tampered with.

Two things end a session deliberately:

• Signing out ends the current session immediately.
• Changing your password signs you out of every session, everywhere, not just the browser where you changed it. This is a safety feature: if you change your password because you suspect someone else had access, that act evicts them.

If you forget your password, you request a password reset from the sign-in page. Truestamp emails you a time-limited reset link; following it lets you set a new password. As above, completing a reset signs out any existing sessions.

What this protects against

Truestamp’s sign-in design defends against the common ways accounts are attacked:

• Online password guessing is throttled per email address, so an attacker cannot rapidly try many passwords against your account. Every attempt counts toward the limit, right or wrong.
• A stolen or reused password alone is not enough when you have two-factor enabled, because the attacker would also need a live code from your authenticator app.
• Second-factor code guessing is throttled to a few attempts per window, so brute-forcing the short-lived 6-digit code is impractical.
• A half-finished sign-in cannot reach your data: with two-factor enabled, you must pass the second-factor step before any protected page will load.
• A suspected compromise can be shut down by changing your password, which ends every active session at once.
• Recovery codes are single-use, so a leaked one cannot be replayed, and you can rotate the whole batch whenever you want.

Limitations

Truestamp secures the account you use to submit data and manage your work; it is distinct from the cryptographic proofs Truestamp produces. Anyone can verify a proof without signing in at all, so account authentication is about who may create and manage data in Truestamp, not about who may check a proof.

Two-factor authentication is optional. If you do not enable it, your account is protected by your password (or magic link) and the sign-in throttling alone; enabling two-factor is strongly recommended for meaningful protection against a stolen password. Recovery codes exist only while two-factor is enabled, and they are your responsibility to store safely, because losing both your authenticator app and your recovery codes can lock you out of your own account. If you are locked out, see support and contact channels.