Login problems, lockouts, and rate limits
Sign-in errors here are deliberately terse. That's a security property, not sloppiness. Here is what each one actually means and what to do.
"Incorrect e-mail or password."
This message is identical for a wrong password, for an address that has no account, and for an account locked after too many failed attempts. On purpose: if any of those read differently, anyone could use the sign-in form to test which e-mail addresses have accounts. So check both: the address for typos, then the password. If you genuinely can't remember whether you signed up, try registering: a taken address answers "That e-mail is already registered."
"Too many attempts. Please wait and try again."
Too many sign-in attempts from one address or one connection in a short window. Wait it out. Retrying resets nothing in your favor.
Separately, eight failed attempts lock the account for 15 minutes. A locked account answers "Incorrect e-mail or password.", the same as a wrong password, so the lock never reveals that an address has an account. During those 15 minutes even the right password is turned away. The fastest way back in is a password reset: it lifts the lock at once.
Reset and verification links
- A password-reset link expires after one hour.
- Each new reset request cancels the previous link: if you asked twice, only the newest e-mail works.
- Registration and reset requests are rate-limited per hour, so don't hammer the button. If nothing arrives, check spam before requesting again.
- E-mail verification links last 3 days.
"This account is suspended."
You only ever see this after entering the correct password: an attacker who doesn't have it can't learn the account exists. If you believe the suspension is a mistake, contact us.
Google sign-in
If the Google button says "Google sign-in isn't connected yet. Use your e-mail address for now.", that's the current state: the button ships ahead of the connection. Sign in with your e-mail address and password.
Quick answers
I know the password is right. Why won't it let me in?
A lockout may be active from earlier failed attempts, yours or someone else's, and a locked account answers exactly like a wrong password. Wait 15 minutes and try once, cleanly, or reset your password, which lifts the lock at once.
The reset e-mail never arrived.
Check spam first. Then note that only the newest link works (a second request kills the first) and requests are rate-limited per hour.
Can someone use the login form to find out if I have an account?
Not from the error messages: wrong-password and no-such-account answer identically, and a suspended account only reveals itself after a correct password.