Security and two-step login

How accounts and records are protected.

• Passwords are stored as salted scrypt hashes, never in plain text.
• Sessions use secure, http-only cookies and can be signed out per device under Account and security.
• Repeated wrong passwords lock sign-in for a while.
• Two-step login adds a 6-digit code from an authenticator app, with one-time recovery codes.
• Record histories are hash-chained, so changes to old entries are detectable.

Turn on two-step login

1. 1Open Account and security.
2. 2Choose Set up and scan the QR code with Apple Passwords, Google Authenticator, Microsoft Authenticator or 1Password.
3. 3Enter the 6-digit code to confirm.
4. 4Save your recovery codes somewhere safe.