Security: passwords, sessions and logging out everywhere
Password rules, how sessions work, password reset, login throttling, your exchange keys, and what to do if you suspect your account was used by someone else.
Password rules
A password must be at least 10 characters and mix upper and lower case letters with at least one digit. Passwords are stored only as a strong one-way hash: nobody, including support, can see your password; you can only set a new one.
Change it under Account > Security: enter the current password and the new one twice. Changing the password logs out every session, including the one you are using, so sign in again afterwards.
Sessions
Signing in creates a session held in a secure, HttpOnly browser cookie, valid for about a month. Only a hash of the session token is stored on the server, and the live data connection of the app is authenticated with the same session.
Account > Security lists your active sessions with the IP address, browser and creation time. Log out everywhere ends every session, including this one: the right move after using a shared computer or if you suspect someone else has your login.
Log out in the top-bar menu ends only the current session.
Forgotten password
Click Forgot password on the login page and enter your email. You receive a single-use link that expires after a while; set a new password on that page. If no email arrives, check spam and then contact support.
Login throttling
After repeated wrong passwords for the same email from the same address, logins are paused for a short time with the message Too many attempts. Try again in 15 minutes. A successful login clears the counter.
Form protection
Forms carry a token tied to your session; if a form says Form expired, reload the page and try again. your session changed while the page was open. Calls from the app are accepted only from the site itself.
Exchange keys and the keyring
Exchange API keys are not protected by your account password. They are encrypted with the separate keyring password you set on the Trading page, which is never stored and is held in the server's memory only during your login session. Someone who obtains your account password still cannot use your keys without the keyring password. Create keys with trade permission only, never withdrawal. See Exchange trading accounts.
If you suspect misuse
- Account > Security > Log out everywhere.
- Change your password.
- On the exchange, delete the API keys you had stored and create new ones; then unlock the keyring and save the new keys.
- Check Account > Billing and Account > Wallet for anything you did not do and tell support.
Disabled accounts
The operator can disable an account; login then fails with This account is disabled. Contact support. Disabling does not delete data.
Note: we never ask for your password, keyring password or exchange secrets by email or chat. Treat any such request as fraud.