Signing In

Everything between having no account and being inside the app at https://app.credenshare.io.

Creating an account

Registration is at /register. You need a first name, last name, email address and password; company is optional.

The form lists five password requirements and ticks them off as you type:

• At least 8 characters
• One uppercase letter
• One lowercase letter
• One number
• One special character

A strength meter sits above the list and rates the password from Very Weak to Very Strong. The rating is advice and does not block the form. The form itself refuses a password shorter than 8 characters, or one that does not match the confirmation field.

Below the password fields are three checkboxes:

Neither mail checkbox affects whether the account is created.

Submitting shows Account Created! and sends you to the verification step. You cannot sign in until the account is verified.

Verifying your email

Registration sends a 6-digit code to the address you signed up with. Enter it at /confirm along with your email address.

• A wrong or stale code gives Verification Failed with Invalid or expired code.
• Success gives Email Verified! and drops you at the login page.

If the code never arrives, use Resend verification code at the bottom of the same page. After a resend the button is disabled and counts down — Resend code in 60s — so a second resend is possible one minute later. If you have closed the page entirely, /reset-registration takes an email address and issues a fresh code.

Trying to sign in before verifying does not fail silently. You get Email Not Verified with Please verify your email address to continue. and land back on the verification page.

Signing in

Sign in at /login with your email address and password.

An unknown email address and a wrong password produce the same refusal — Login Failed with Incorrect username or password. The two cases are deliberately indistinguishable, so the message is not evidence that the account does not exist.

Two things may interrupt a correct sign-in:

• Terms of Service Update — a modal asking you to review and accept the current terms. It cannot be dismissed by clicking outside it. I Agree & Continue records the agreement timestamp against your account and completes the sign-in; Cancel returns you to the login form without agreeing, and the modal reappears on the next attempt.
• Two-factor authentication — if you have a second factor enabled, see Two-factor authentication below.

Sign-in, registration and password reset are all screened by an invisible reCAPTCHA check in the background. Nothing is asked of you unless the check fails, in which case you get Verification Failed with Captcha verification failed. Please refresh and try again.

Signing in with Google

Both /login and /register carry a Google button below the email and password form — Continue with Google on /login, Sign up with Google on /register. It takes you to Google, then back through a page that reads Signing you in… and on to the app.

Sign in the way you signed up. The password form is for accounts registered with an email address and password; an account created through Google is signed in with the Google button.

If your Google address already belongs to a CredenShare account, the two are linked automatically and you land in that existing account with your existing data. You do not end up with a second, empty account.

The callback page phrases failures in plain language rather than showing the raw error. The ones worth recognising:

Two-factor authentication

Two-factor authentication is set up in the app under Account → Security → Two-factor authentication. It is available on every plan, including Free.

The product supports two second factors. There is no SMS option.

Enabling the authenticator app

Press Enable 2FA. A modal shows a QR code to scan, and the same secret in text for apps that cannot scan. Copying the secret puts it on your clipboard for 30 seconds and then clears it, so paste it into your authenticator app straight away. Enter the 6-digit code your app generates and press Enable 2FA again to confirm. A wrong code keeps the modal open with Verification failed. Check the code and try again.

Enabling email codes

Press Enable on the Email MFA row. There is no code to confirm; the row flips to Active and the next sign-in asks for an emailed code.

Choosing which one you are asked for

With both factors active, a Preferred method at sign-in control appears with two options — Authenticator app and Email code. Until you pick one, sign-in shows a Choose a verification method screen and you take either route each time. Once a preferred method is set, sign-in challenges that method directly and the challenge page offers no way to switch to the other one — change the preference from a signed-in session if you want the other factor challenged.

The sign-in challenge

After your password is accepted you land on a two-factor page asking for the 6-digit code, with a live countdown reading Code expires in 2:47.

Turning a factor off

Disabling either factor requires your current password, entered in the confirmation modal — knowing the second factor is not enough on its own. This applies to both Disable 2FA and Disable email MFA. If the password is wrong you get Check your password and try again.

Trusted devices

The two-factor challenge carries a Trust this device for 30 days checkbox. Tick it and that browser is not asked for a code again for 30 days. Only tick it on a device only you use.

Trusted browsers are listed under Account → Security → Trusted devices, each row showing the device name, when it was last used, and when it was trusted. The browser you are currently in is tagged This device.

To remove one, press Forget on its row and confirm. The next sign-in from that browser needs a fresh code again. Forgetting the browser you are sitting in works the same way and takes effect on its next sign-in.

With no trusted devices the section reads No trusted devices. You'll be prompted for a 2FA code on every login. — which is the safest state, not an error.

Forgotten password

1. On /login, follow Forgot password?, or go to /reset-password directly.
2. Enter your email address. A reset code is emailed to you.
3. At /confirm-password, enter the code and choose a new password. The same 8-character minimum applies.
4. You are returned to the sign-in page. Sign in with the new password.

Two things to know:

• The form always reports success. Reset Code Sent appears whether or not an account exists for that address, for the same anti-enumeration reason as the resend form. Only genuine throttling is surfaced, as Too many attempts. Please wait a bit and try again.
• A password reset does not remove your second factor. Enrolment survives the reset, so the next sign-in still asks for a code.

If you know your current password and simply want to change it, use Account → Security → Change Password instead; that form asks for the old password. It holds the new one to all five requirements listed above and refuses anything short of them with Password must have: followed by the ones you missed.

Being signed out automatically

Sessions end on their own in two ways, and both are enforced on the server rather than in the browser — an over-idle request is refused and the session cleared, whatever the page thinks.

Inactivity. Under Account → Security → Automatic Logout you choose your own limit: No automatic logout, 15 minutes, 30 minutes, 1 hour, 4 hours, 8 hours or 24 hours.

A team owner can cap the whole team. In the team settings an owner sets a maximum inactivity timeout — the same list of durations, with No limit as the open option. The limit that applies to you is the shorter of your own setting and the team cap. The cap covers the owner too; it is not a members-only control.

Shortly before the cutoff a Still there? modal counts down, offering Stay logged in or Log out now. If it lapses you are signed out and told You were signed out due to inactivity. If a session dies while you are away from the keyboard, the next action gives Session Expired with Please log in again to continue.

The session ceiling. Even with automatic logout switched off, a signed-in session lasts at most 30 days before you must sign in again.

Locked out

Work down this list — the first row that matches is your path back in.

Be clear about what support cannot do, because it shapes what is worth asking for:

• Support cannot generate a two-factor code for you, or wave a sign-in past the challenge from inside the app — the product has no such control.
• Support cannot read the contents of your shares. Credentials created in the app, the API or an SDK are encrypted in your browser and the key never reaches our servers, so there is nothing on our side to hand back. This holds on every plan, Free included, and is separate from the zero-knowledge custody entitlement below. Shares created through the Slack app are the exception — those are encrypted on our servers under a KMS key.
• Support cannot recover a lost zero-knowledge passphrase on Business or Enterprise. Content wrapped under it stays unreadable.

Regaining access to an account is a manual, human process, so the more you can evidence about the account — the registered address, the company on it, the billing details — the faster it goes.