User Authentication
Last updated: 2026-09-30
This page explains Lorel.ai’s authentication features: creating a new user account (sign-up), logging in, two-factor authentication (MFA), password management, and account deletion.
Overview
Lorel.ai provides password-strength checks and app-based (TOTP) two-factor authentication (MFA) to help you use the service safely.
- Secure account management: a 15-character minimum password requirement, checked against known leaked passwords.
- Two-factor authentication (MFA): an authenticator app helps prevent unauthorized logins.
- Account procedures: change/reset your password, delete your user account, and similar actions.
What you can do
| Feature/action | Description | Applies to |
|---|---|---|
| Sign up | Register an email address and password to create a new user account | Unregistered users |
| Confirm email address | Enter the 6-digit confirmation code to activate the account and start using it | At sign-up |
| Log in | Sign in with email and password (two-step if MFA is configured) | All users |
| Configure/use MFA | Optionally enable app-based two-step authentication to strengthen login security | All users (optional) |
| Log out | End the login session on the current device | Logged-in users |
| Change password | Change your password at any time from the logged-in screen | Logged-in users |
| Reset password | Receive a reset email and set a new password if you’ve forgotten it | All users |
| Delete user account | Permanently delete your own user account | All users (except the sole Owner of an organization) |
Sign-up and email confirmation
- Open the sign-up screen (
/register) and enter an email address and a password (15+ characters) to register.- If the email address is already registered, the screen still accepts the submission as usual (to prevent third parties from probing which addresses exist), but a notification email about the sign-up attempt is sent to that address. If this wasn’t you, we recommend changing your password.
- After registering, you’re taken to the “Verify your email” screen. Entering the 6-digit confirmation code (valid for 30 minutes) sent to your email activates the account and logs you in automatically.
- Five consecutive incorrect entries invalidate the code, requiring a resend.
- You cannot log in until your email address has been confirmed.
- To prevent third parties from probing which addresses are registered, clicking “Resend code” for an unregistered address shows the same “sent” confirmation as for a registered one.
Password requirements
| Item | Requirement |
|---|---|
| Length | 15+ characters (mixing uppercase, lowercase, digits, and symbols is not required) |
| Security check | Checked against a database of passwords known to have been leaked elsewhere. A matching password cannot be set |
Logging in and out
- Login: enter your email and password. If MFA isn’t configured, login completes once authentication succeeds; if MFA is configured, you must also enter the 6-digit code from your authenticator app (within 5 minutes). To prevent account existence from being inferred externally, an unregistered or suspended account shows the same error message as an incorrect password.
- Session lifetime: your login session refreshes automatically with every action and is kept for up to 7 days from your last action. After 7 days of inactivity, you’re automatically logged out.
- Scope of logout: logging out ends the login session only on the current device/browser (sessions on other devices remain active). If your session has already expired when you log out, no error is shown — you’re simply taken to the login screen. To log out everywhere at once, change or reset your password (this invalidates sessions on all devices).
- Rate limiting: repeated failed attempts within a short time — for login, password change/reset, confirmation code entry, MFA setup changes, or account deletion — trigger progressively longer wait times.
Configuring and managing MFA
Two-factor authentication (TOTP: Time-based One-Time Password) is an optional, per-user feature that strengthens login security (there is no mechanism to force it for every organization member). The confirmation code refreshes every 30 seconds (allowing for clock drift between your device and the server, codes from one interval before or after — roughly ±30 seconds — are also accepted). A confirmation code cannot be reused once used, whether for enabling, disabling, confirming at login, or deleting your account. If you need to perform another action right after, wait for the next code (30 seconds later) before entering it.
Enabling MFA: from the user icon menu, open “Account settings,” then the “Two-Factor Authentication (MFA)” area under “Security,” and enter your current password to begin. Scan the QR code with your authenticator app (or enter the manual setup code), then enter the resulting 6-digit code to complete setup.
Disabling MFA: from the same “Two-Factor Authentication (MFA)” area, choose to disable it, then enter your current password and a valid 6-digit code from your authenticator app.
If your device’s clock is significantly out of sync, a correct confirmation code may still be rejected. Make sure your device’s automatic (network) time sync is enabled.
Changing and resetting your password
- Change (while logged in): in the “Change Password” area of Account Settings, enter your current password, a new password (15+ characters), and the new password again to confirm it. The new password is also checked against known leaked passwords.
- Reset (if forgotten): from “Forgot your password?” on the login screen, enter your email address to receive a reset email (link valid for 1 hour). Follow the link to set a new password.
- Completing a password change or reset automatically logs out every device/browser session, including the one you just used to make the change (credentials issued just before may remain valid for up to 15 minutes).
Deleting your user account
You can permanently delete your own Lorel.ai user account.
- Before deleting: if you are the sole Owner of an organization, you cannot delete your account as-is, to avoid leaving that organization without an administrator. You must first transfer the Owner role to another member, or request deletion of the organization through the contact form.
- Deletion steps: from the Account Settings menu, choose “Delete account,” check the box confirming you understand this action cannot be undone, and enter your current password (and, if MFA is enabled, a confirmation code) to complete the deletion.
- After deletion: all your sessions across every device/browser end immediately, and you’re automatically removed from every organization and project you belonged to.
Limitations
- There is no feature to require or enforce two-factor authentication (MFA) for every organization member.
- Disabling MFA does not automatically end an already-logged-in session on any device or browser.
- Single sign-on (SSO) and login/linking via external (e.g. social) accounts are not supported.
- No notification email is sent when a password change or an MFA setting change is completed.
- Deleting or suspending a user account invalidates the login session itself immediately, but a credential already issued just beforehand remains valid for up to 15 minutes (its default lifetime), so it may take up to about 15 minutes before all logged-in access is fully cut off.
- The email address entered at sign-up is not checked in advance for deliverability. If you enter it incorrectly, you won’t receive the confirmation code and won’t be able to complete registration — please double-check it.
Related pages
- Organizations and Projects Overview (creating an organization, and its billing-status lifecycle, are out of scope for this page)
- Roles and Permissions (details on role-based constraints, such as the sole-administrator protection that also underlies the “before deleting” restriction above)