Security

How AuthPlus protects accounts and codes, and what is expected of you.

How your account is protected

Measure	Detail
Password storage	Passwords are never stored, and cannot be recovered by anyone including administrators. Only a modern, deliberately slow one-way hash is kept, so a stolen database does not yield usable passwords.
Password rules	Minimum 8 characters. No further complexity is imposed — strength is your responsibility.
One-time codes	6 digits, valid for 10 minutes, at most 5 attempts, single use. Requesting a new code cancels the previous one.
Automated-abuse protection	Sign-in, sign-up, password reset and every public scan carry an invisible proof-of-work check that makes bulk automated attempts expensive (The invisible anti-bot check).
Role separation	Ordinary users cannot reach administrative functions, and administrators cannot alter the superadministrator account.

Sessions and devices

Signing in creates a session that is renewed silently while you work, so you are not interrupted. Sessions are long-lived by design, so that field staff are not asked to sign in repeatedly.

Action	Effect on sessions
Sign out	Ends the session on that device only.
Password reset (from the sign-in page)	Ends every session, on every device.
Password change (from your profile)	Other devices stay signed in.
Email change	Sessions are unaffected.

Warning · If you suspect your account is compromised

Use Forgot password from the sign-in page rather than changing the password inside your profile: only the reset path terminates sessions everywhere. Then review Operations for activity you do not recognise, and tell your administrator.

What makes a code hard to forge

• Unguessable. Codes are random, drawn from a 32-character alphabet that excludes easily confused glyphs, and are 12 to 20 characters long. They are not sequential, so knowing one tells an attacker nothing about another.
• Verified centrally. A code is meaningless on its own — authenticity is decided by the server, not by anything printed on the label.
• Signed for assets and documents. Certificates carry a cryptographic signature over the record’s identity; altering the record breaks the signature and the verdict becomes Verification failed.
• Fingerprinted for files. A certified document is bound to a fingerprint of its exact contents, so any modification is detectable.
• Copy-detection. Because copying a genuine code onto many fakes cannot be prevented physically, AuthPlus detects it statistically through verification ceilings and custody conflicts (Authentic, with a warning).

Note · The physical label matters too

AuthPlus proves that a code is genuine; it cannot know whether the sticker carrying it was moved from a real item onto a fake one. Pair codes with tamper-evident labels or place them where removal destroys them.

The invisible anti-bot check

Before a sign-in, a sign-up, a password reset or a public scan is accepted, your device performs a small computation that proves a real client is present. There is no puzzle, no checkbox and nothing to read.

What you may notice	Explanation
A brief delay before the button responds	Normal, particularly on older devices.
Challenge verification failed	The check expired — usually a page left open a long time. Reload and try again.
Could not fetch verification challenge	The device could not reach the server. Check connectivity.

Good practice for your organisation

• Give each person their own account and their own verifier profile; never share credentials.
• Keep the number of administrators to a minimum and review the list regularly (User management).
• Archive accounts and verifier profiles the day someone leaves.
• Change any initial password set for you by an administrator at first sign-in.
• Sign out on shared or public computers — closing the tab is not enough.
• Treat the CSV of issued codes as confidential: it lists valid codes in bulk.
• Review Warnings and Operations on a regular schedule; nobody is emailed when something suspicious happens (Notifications).