Signing In

Everything between having no account and being inside the app at https://app.credenshare.io.

Creating an account

Registration is at /register. You need a first name, last name, email address and password; company is optional.

The form lists five password requirements and ticks them off as you type:

• At least 8 characters
• One uppercase letter
• One lowercase letter
• One number
• One special character

A strength meter sits above the list and rates the password from Very Weak to Very Strong. The rating is advice and does not block the form. The form itself refuses a password shorter than 8 characters, or one that does not match the confirmation field.

Below the password fields are three checkboxes:

Neither mail checkbox affects whether the account is created.

Submitting shows Account Created! and sends you to the verification step. You cannot sign in until the account is verified.

Verifying your email

Registration sends a 6-digit code to the address you signed up with. Enter it at /confirm along with your email address.

• A wrong or stale code gives Verification Failed with Invalid or expired code.
• Success gives Email Verified! and drops you at the login page.

If the code never arrives, use Resend verification code at the bottom of the same page. After a resend the button is disabled and counts down — Resend code in 60s — so a second resend is possible one minute later. If you have closed the page entirely, /reset-registration takes an email address and issues a fresh code.

A sign-up that is still unconfirmed after 30 days is deleted, and a resend after that sends nothing. To use that address, register again.

Trying to sign in before verifying does not fail silently. You get Email Not Verified with Please verify your email address to continue. and land back on the verification page.

Signing in

Sign in at /login with your email address and password.

An unknown email address and a wrong password produce the same refusal — Login Failed with Incorrect username or password. The two cases are deliberately indistinguishable, so the message is not evidence that the account does not exist.

Two things may interrupt a correct sign-in:

• Terms of Service Update — a modal asking you to review and accept the current terms. It cannot be dismissed by clicking outside it. I Agree & Continue records the agreement timestamp against your account and completes the sign-in; Cancel returns you to the login form without agreeing, and the modal reappears on the next attempt.
• Two-factor authentication — if you have a second factor enabled, see Two-factor authentication below.

Sign-in, registration and password reset are all screened by an invisible reCAPTCHA check in the background. Nothing is asked of you unless the check fails, in which case you get Verification Failed with Captcha verification failed. Please refresh and try again.

Signing in with Google

Both /login and /register carry a Google button below the email and password form — Continue with Google on /login, Sign up with Google on /register. It takes you to Google, then back through a page that reads Signing you in… and on to the app.

Sign in the way you signed up. The password form is for accounts registered with an email address and password; an account created through Google is signed in with the Google button.

If your Google address already belongs to a CredenShare account, the two are linked automatically and you land in that existing account with your existing data. You do not end up with a second, empty account.

The address on an account that signs in with Google comes from Google. If your account was created through Google, or is linked to Google as described above, pressing Send code in Change email shows Your sign-in email comes from your Google account. Change it in Google; CredenShare updates it the next time you sign in with Google. Change the address in your Google account, then sign in to CredenShare with the Google button. CredenShare picks up the new address when you sign in with Google, and emails your previous address a notice that the sign-in email was changed.

The callback page phrases failures in plain language rather than showing the raw error. The ones worth recognising:

Two-factor authentication

Two-factor authentication is set up in the app under Account → Security → Two-factor authentication. It is available on every plan, including Free.

The product supports two second factors. There is no SMS option.

Enabling the authenticator app

Press Enable 2FA. A modal shows a QR code to scan, and the same secret in text for apps that cannot scan. Copying the secret puts it on your clipboard for 30 seconds and then clears it, so paste it into your authenticator app straight away. Enter the 6-digit code your app generates and press Enable 2FA again to confirm. A wrong code keeps the modal open with an error message; enter the current code from your app and try again. If email MFA is already on, Enable 2FA may first open the Confirm it's you window described below.

Enabling email codes

Press Enable on the Email MFA row. There is no setup code to confirm; the row flips to Active. If email is your only factor, the next sign-in asks for an emailed code. If the authenticator app is also on, which code sign-in asks for depends on your preferred method; see Choosing which one you are asked for. In that case Enable may first open the Confirm it's you window described below.

Choosing which one you are asked for

With both factors active, a Preferred method at sign-in control appears with two options — Authenticator app and Email code. Until you pick one, sign-in shows a Choose a verification method screen and you take either route each time. Once a preferred method is set, sign-in challenges that method directly and the challenge page offers no way to switch to the other one — change the preference from a signed-in session if you want the other factor challenged. Changing the preference may first open the Confirm it's you window described below.

The sign-in challenge

After your password is accepted you land on a two-factor page asking for the 6-digit code, with a live countdown reading Code expires in 2:47.

Turning a factor off

Press Disable 2FA on the authenticator row, or Disable on the Email MFA row. A confirmation window warns that this removes a layer of protection from your account; confirm with Disable 2FA or Disable email MFA. Confirming may first open the Confirm it's you window described in the next section.

Changes need a recent two-step check

Once a factor is on, the app asks for a recent two-factor check before it changes your two-factor settings: turning either factor on or off, changing the preferred method, or setting up the authenticator app again. Turning on your first factor does not ask for one.

If you entered a two-factor code in this browser session in the last 10 minutes, at sign-in or in an earlier Confirm it's you window, the change goes ahead without asking again. Otherwise a Confirm it's you window opens. It asks for your password, then for a code from your second factor. After the password, if both factors are on and no preferred method is set, it asks How would you like to get your code? Once the code is accepted, the app makes the change you asked for. Trusting the browser does not skip this code.

A wrong password gives That password isn't right. A wrong code gives That code isn't right. Check it and try again.

The same check comes before Change email on an account with two-factor authentication. See Changing your sign-in email.

Trusted devices

The two-factor challenge carries a Trust this device for 30 days checkbox. Tick it and that browser is not asked for a code at sign-in for 30 days. Only tick it on a device only you use. Trust applies to signing in: changing two-factor settings or your sign-in email from a trusted browser can still ask for your password and a code. See Changes need a recent two-step check.

Trusted browsers are listed under Account → Security → Trusted devices, each row showing the device name, when it was last used, and when it was trusted. The browser you are currently in is tagged This device.

To remove one, press Forget on its row and confirm. The next sign-in from that browser needs a fresh code again. Forgetting the browser you are sitting in works the same way and takes effect on its next sign-in. Changing your sign-in email also makes the app try to forget every trusted device; see Changing your sign-in email.

With none listed the section reads No trusted devices are listed for your account.

Forgotten password

1. On /login, follow Forgot password?, or go to /reset-password directly.
2. Enter your email address. A reset code is emailed to you.
3. At /confirm-password, enter the code and choose a new password. The same 8-character minimum applies.
4. You are returned to the sign-in page. Sign in with the new password.

Two things to know:

• The form always reports success. Reset Code Sent appears whether or not an account exists for that address, for the same anti-enumeration reason as the resend form. Only genuine throttling is surfaced, as Too many attempts. Please wait a bit and try again.
• A password reset does not remove your second factor. Enrolment survives the reset, so the next sign-in still asks for a code.

If you know your current password and simply want to change it, use Account → Security → Change Password instead; that form asks for the old password. It holds the new one to all five requirements listed above and refuses anything short of them with Password must have: followed by the ones you missed.

Changing your sign-in email

The Email section at the top of Account → Profile shows the address you sign in with. You cannot edit it there; use Change email beside it. The Change your sign-in email window takes two codes:

1. Enter the new address and press Send code. A security code goes to your current address. It expires after 15 minutes.
2. Enter that code and press Continue. A confirmation code then goes to the new address.
3. Enter the code from the new address and press Confirm. The window reads Email changed, and from then on you sign in with the new address.

Until step 3 is done, keep signing in with your current address. The email to the new address links back to step 3, so you can finish from it while signed in. If that code has expired, choose Start again.

With two-factor authentication on, Send code may first open the Confirm it's you window. See Changes need a recent two-step check.

After the change:

• CredenShare emails your previous address a notice headed Your CredenShare sign-in email was changed. If you did not make the change, write to support@credenshare.io from that address.
• The app tries to forget your trusted devices, so that each one asks for a two-factor code again. When that worked, Email changed says so, and you may be asked to sign in again soon. When it did not, it asks you to review Trusted devices in the Security tab and forget any you do not recognise.

If you receive an email headed A change to your CredenShare sign-in email was stopped, someone tried to change your sign-in email without these steps, and no confirmation code was sent for that change. If it was not you, someone may have access to your account: sign in, change your password and contact support@credenshare.io.

The first code goes to your current inbox. If you can no longer reach that inbox, write to support@credenshare.io instead.

If your account signs in with Google, or is linked to Google, change the address in Google instead. See Signing in with Google.

Being signed out automatically

Sessions end on their own in two ways, and both are enforced on the server rather than in the browser — an over-idle request is refused and the session cleared, whatever the page thinks.

Inactivity. Under Account → Security → Automatic Logout you choose your own limit: No automatic logout, 15 minutes, 30 minutes, 1 hour, 4 hours, 8 hours or 24 hours.

A team owner can cap the whole team. In the team settings an owner sets a maximum inactivity timeout — the same list of durations, with No limit as the open option. The limit that applies to you is the shorter of your own setting and the team cap. The cap covers the owner too; it is not a members-only control.

Shortly before the cutoff a Still there? modal counts down, offering Stay logged in or Log out now. If it lapses you are signed out and told You were signed out due to inactivity. If a session dies while you are away from the keyboard, the next action gives Session Expired with Please log in again to continue.

The session ceiling. Even with automatic logout switched off, a signed-in session lasts at most 30 days before you must sign in again.

Locked out

Work down this list — the first row that matches is your path back in.

Be clear about what support cannot do, because it shapes what is worth asking for:

• Support cannot generate a two-factor code for you, or wave a sign-in past the challenge from inside the app — the product has no such control.
• Support cannot read the contents of your shares. Credentials created in the app, the API or an SDK are encrypted in your browser and the key never reaches our servers in the clear, so there is nothing on our side that we could open and hand back. This holds on every plan, Free included, and is separate from the zero-knowledge custody entitlement below. Shares created through the Slack app are the exception — those are encrypted on our servers under a KMS key.
• Support cannot recover a lost zero-knowledge passphrase on Business or Enterprise. Unless you still have an activated device, which can set a new passphrase without losing anything, content wrapped under it stays unreadable.

Regaining access to an account is a manual, human process, so the more you can evidence about the account — the registered address, the company on it, the billing details — the faster it goes.