Account and Sign-In

Registration

Open /register and enter email, password, and password confirmation. The password needs at least 8 characters, at most 100, and at least one number. Emails are stored in lowercase. After registering you are signed in automatically.

Who may register depends on SINGLE_USER_MODE:

• true (default in the provided Docker setups): only the first account can register; afterwards registration is refused ("Registration is disabled. This instance is configured for a single user.").
• false or unset: registration is open.

Registration attempts are rate limited per address. There is no email verification.

If email delivery is configured, a welcome email is sent after registration; failures are ignored.

Sign In

Open /login and enter email and password. Wrong credentials show "Invalid email or password."

Forgot Password

1. Click Forgot password? on the sign-in page and enter your email.
2. If an account exists and email delivery is configured, you receive a reset link. The page always shows the same message ("If an account exists with this email, you will receive a reset link."), so it does not reveal whether an address is registered. At most 3 requests per hour per address are processed.
3. Open the link within 1 hour, enter a new password (same rules as above), and sign in again.

Email delivery needs SMTP (SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, optional SMTP_FROM) or EMAIL_TRANSPORT=sendmail on the server. Without it, no reset email is sent; the operator must provide it. A link can be used once; resetting a password signs out all other sessions.

Session Expired

If your session is ended on the server (for example after a password reset), you are redirected to /session-expired, which clears the session cookie and sends you to the sign-in page.

Sign Out

Use the sign-out button in the sidebar. It also deletes the offline page cache of your account in this browser (see Search, Offline, and Reminders).