Login problems, lockouts, and rate limits
Sign-in errors here are deliberately terse. That's a security property, not sloppiness. Here is what each one actually means and what to do.
"Incorrect email or password."
This message is identical for a wrong password and for an address that has no account. On purpose: if the two cases read differently, anyone could use the sign-in form to test which e-mail addresses have accounts. So check both: the address for typos, then the password. If you genuinely can't remember whether you signed up, try registering: a taken address answers "That email is already registered."
"Too many failed attempts. Try again shortly."
Eight failed sign-in attempts lock the account for 15 minutes. The same message also covers plain rate limiting, and the two are deliberately indistinguishable from the outside. Wait it out. Retrying resets nothing in your favor. If you're no longer sure of the password, request a reset link while you wait.
Reset and verification links
- A password-reset link expires after one hour.
- Each new reset request cancels the previous link: if you asked twice, only the newest e-mail works.
- Registration and reset requests are rate-limited per hour, so don't hammer the button. If nothing arrives, check spam before requesting again.
- E-mail verification links last 3 days.
"This account is suspended."
You only ever see this after entering the correct password: an attacker who doesn't have it can't learn the account exists. If you believe the suspension is a mistake, contact us.
Google sign-in
If the Google button says "Google sign-in isn't connected yet. Use your e-mail address for now.", that's the current state: the button ships ahead of the connection. Sign in with your e-mail address and password.
Quick answers
I know the password is right. Why won't it let me in?
A lockout may be active from earlier failed attempts, yours or someone else's. Wait 15 minutes and try once, cleanly.
The reset e-mail never arrived.
Check spam first. Then note that only the newest link works (a second request kills the first) and requests are rate-limited per hour.
Can someone use the login form to find out if I have an account?
Not from the error messages: wrong-password and no-such-account answer identically, and a suspended account only reveals itself after a correct password.