How sign-in and security work

The code

Each code is random, works once and expires after 10 minutes. The email and the Log in to Omne button carry the same one-time code. Codes are stored hashed on the server, so reading the database does not reveal them.

Limits that protect you

• A code is dropped after 3 wrong tries.
• Omne sends at most 6 codes to one address every 10 minutes.
• After 5 wrong codes in an hour, or 20 in a day, every code for that address is refused until the window ends.
• Per-visitor limits also apply to requests for codes and tries.

These limits stop someone guessing your code from many places. The cost is that someone who knows your address could lock you out for a while. If that happens, see Too many tries.

Providers

On the sign-in page each provider has a Continue with button. If one is not switched on, it says "{name} isn't connected yet." Continue with SAML SSO is for the Enterprise plan. See Enterprise plan.

Devices you are signed in on

Open Settings, then Security. Under Where you're signed in you see each browser and device with its sign-in date. Click Sign out next to any you do not recognise, or Sign out every other device. Your current one is marked This device.

Verified badge

The Identity verification card offers Verify my identity, which gives a verified badge on your profile. The screen says Didit checks a government ID and a selfie. It is optional.

Invite-only

While Omne is in private beta, only invited addresses can sign in. See Is Omne free during the private beta?.