Account security: sign-in, MFA and sessions

Passwords and lockout

Passwords must be at least 12 characters. Ten wrong passwords or MFA codes lock the account for 15 minutes.

MFA

Each code from your authenticator app is accepted once: after a code is used, the same code — or an older one — is refused, so a code someone reads over your shoulder can't be reused while it's still showing.

Replacing your authenticator needs your current password and a current code from the old one. Your old authenticator keeps working until you confirm a code from the new one, so closing the setup screen halfway leaves you able to sign in as before.

Sessions

You stay signed in for up to 30 days from when you signed in; after that, sign in again. Using Graften doesn't extend that. A session you haven't used for 7 days ends sooner: opening Graften in that browser at least once a week keeps it going until the 30 days are up.

Changes to an account take effect immediately, on every device:

• changing your password signs you out everywhere except the device you changed it on;
• a password reset signs you out everywhere;
• when an admin changes your role, the new role applies straight away;
• when an admin disables or removes a user, that user is signed out at once.

Account → Security shows how many signed-in sessions you have and when you last signed in. Sign out everywhere ends all of them, this one included, and you sign in again. You can change your password there too.