Login problems, lockouts, and rate limits
Sign-in errors here are deliberately terse. That's a security property, not sloppiness — here is what each one actually means and what to do.
"Incorrect email or password."
This message is identical for a wrong password and for an address that has no account. On purpose: if the two cases read differently, anyone could use the sign-in form to test which e-mail addresses have accounts. So check both — the address for typos, then the password. If you genuinely can't remember whether you signed up, try registering: a taken address answers "That email is already registered."
"Too many failed attempts. Try again shortly."
Eight failed sign-in attempts lock the account for 15 minutes. The same message also covers plain rate limiting, and the two are deliberately indistinguishable from the outside. Wait it out — retrying resets nothing in your favor. If you're no longer sure of the password, request a reset link while you wait.
Reset and verification links
- A password-reset link expires after one hour.
- Each new reset request cancels the previous link — if you asked twice, only the newest e-mail works.
- Registration and reset requests are rate-limited per hour, so don't hammer the button. If nothing arrives, check spam before requesting again.
- E-mail verification links last 3 days.
"This account is suspended."
You only ever see this after entering the correct password — an attacker who doesn't have it can't learn the account exists. If you believe the suspension is a mistake, contact us.
Google sign-in
If the Google button says "Google sign-in isn't connected yet. Use your e-mail address for now.", that's the current state — the button ships ahead of the connection. Sign in with your e-mail address and password.
Quick answers
I know the password is right. Why won't it let me in?
A lockout may be active from earlier failed attempts — yours or someone else's. Wait 15 minutes and try once, cleanly.
The reset e-mail never arrived.
Check spam first. Then note that only the newest link works — a second request kills the first — and requests are rate-limited per hour.
Can someone use the login form to find out if I have an account?
Not from the error messages: wrong-password and no-such-account answer identically, and a suspended account only reveals itself after a correct password.