Signing In
Sign in with your email and password or with a passkey, answer the two-factor challenge, stay signed in, and recover when a password or link no longer works.
By the end of this page you will know every way into your account, what the sign-in page refuses and why, and how to get back in when a password or an emailed link has stopped working.
Before you begin
| You need | Why |
|---|---|
| An accepted invitation | Accounts are created by invitation only; the sign-in page has no sign-up link. See Your account. |
| A verified address | The sign-in page refuses an address that has not been verified yet, and offers to send the verification email again. |
| Your password, or a passkey | A passkey registered on the device you are using signs you in without a password at all. |
Sign in with your password
- Open the sign-in page. It is where every link into the application sends you while you are signed out.
- Enter your email address. Capitalisation and surrounding spaces do not matter;
Nimal@Example.comandnimal@example.comare the same account. - Enter your password. The eye icon shows what you typed.
- Tick Remember Me if the device is yours and you want to stay signed in after closing the browser.
- Press Log in to Zuse Bifrost.
A wrong address or a wrong password gets the same answer, so the page never confirms which addresses have accounts. After five failed attempts for the same address from the same connection, the page locks that address for a minute and says how long to wait; a correct password does not get through during the lockout.
Where you land next depends on your account:
- With no second factor, you arrive on the Dashboard, or on the page you were trying to open before you were sent to sign in.
- With two-factor authentication turned on, you are taken to the two-factor challenge first.
Sign in with a passkey
A passkey is a credential stored on your device or in your password manager that signs you in with a fingerprint, a face scan or the device's screen lock. Nothing is typed and nothing can be phished.
- Open the sign-in page. If your browser holds a passkey for Zuse Bifrost, it offers it as soon as you focus the email field, the way it offers a saved password.
- Pick the passkey. You may have one per device.
- Unlock it with your biometric or your screen lock.
You are signed in straight away. A passkey already proves the device and the person holding it, so the two-factor challenge is not asked on top of it.
A passkey works only on a device or password manager that holds it, and only on the same web address it was registered against. On a new device, sign in with your password instead.
Answer the two-factor challenge
When two-factor authentication is on for your account, a correct password is only the first step. Nobody is signed in yet; the page waits for a code.
- Open your authenticator app and find the Zuse Bifrost entry.
- Type the six-digit authentication code. The page submits on its own as soon as the sixth digit is in; Continue does the same by hand. Pasting a code fills all six boxes at once.
- You are signed in, and your Remember Me choice from the password step is honoured.
If you cannot reach your authenticator, choose login using a recovery code and paste one of the recovery codes you saved when you turned the second factor on. A recovery code works once and is then spent; the rest remain valid. A code followed by other text is not accepted, so paste the code alone.
Five wrong codes in a row lock the challenge for a minute. The lock is per account, not per connection, because whoever is guessing already holds the password.
The challenge is only a parked sign-in. Closing the browser abandons it, and signing in again starts from the password. It never blocks an account that is already signed in elsewhere.
Stay signed in
Remember Me keeps your session alive after you close the browser, on that device, until you sign out or your password changes. Leave it unticked on a shared computer. Resetting your password from an emailed link signs every remembered browser out at once, which is the quickest way to shut a device out when you no longer hold it.
If you forgot your password
- On the sign-in page, follow Forgot your password?.
- Enter your email address and press Email Password Reset Link.
- The page answers A reset link will be sent if the account exists, whatever you typed. It says the same thing for an address nobody registered, so it cannot be used to find out who has an account.
- Open the email and follow the link. It opens the Reset Password page with your address filled in.
- Choose a new password, confirm it, and press Reset Password. You are sent to the sign-in page with a confirmation and can sign in with the new password straight away.
A reset link works for one hour and once. An expired or already-used link is refused on the reset page with the reason, and you simply ask for another. Five requests a minute from one connection are accepted; after that the page asks you to wait.
If your address is not verified yet
Until the address on your account is verified, the sign-in page refuses it even with the right password and says so. Beneath the message it offers Send me a new verification email; press it and a fresh link goes to your inbox. One link a minute is sent per address, and the page tells you how long to wait if you ask again too soon.
A verification link lives for a day and works once. A link that has expired, or that was altered on its way to you, lands on the This verification link has expired page, where you type your address and receive a fresh one. That page answers in the same words whether or not the address has an unverified account, so it tells a stranger nothing.
Following a valid link verifies the address and signs you in, or takes you to the two-factor challenge when your account has one. A link for an address that is already verified changes nothing and signs nobody in: it proves an inbox, not a password.
If your account was deactivated
A workspace admin can deactivate an account when someone leaves. The sign-in page then refuses the right password with This account has been deactivated. Ask a workspace admin to restore it.; a passkey and an emailed link are refused the same way. Your history stays attached to the account, and an admin can restore it.
Signing out
Open the account menu at the bottom of the sidebar (top right on a phone) and choose Log Out. Signing out ends the session on that device only; other devices you ticked Remember Me on stay signed in until you sign out there or reset your password.
A sign-out link that reaches you from outside the application, such as one in an email, opens a page that signs you out as it loads. If the link was planted on another site, the page shows a button instead and waits for you, so nobody can end your session by making you follow a link.
Frequently asked
Related
- Two-factor authentication: turning the code on, recovery codes, moving phones.
- Passkeys: registering and removing passkeys.
- Browser sessions: which browsers are signed in, and signing the others out.
- Your account: how accounts are created and why they are personal.
How is this guide?
Last updated on
Accepting an Invitation
What happens when you follow an invitation link, whether you are new, already have an account, or are signed in as someone else, and why the link is signed.
Changing Your Password
Set a new password from Account Settings → Security, what the form asks for, what happens to your other sessions, and how an account that signs in with a passkey alone sets one.