Docs

Type to search every page.

Security and privacy

Signing in safely

Passwords, two-step sign-in, passkeys, the app lock, signing in with your phone, sessions and security alerts.

Everything here lives under Settings › Security.

Passwords#

Passwords need at least 10 characters. They’re stored only as a salted hash (scrypt), so nobody can read them back, us included. Sign-in attempts are rate limited.

Forgot it? Use Forgot password on the sign-in page. The emailed link works once and expires in an hour. Resetting signs you out everywhere else.

You can also sign in with Google. Google is never linked to an existing account automatically; connect it under Sign-in methods once you’re signed in.

Two-step sign-in#

Two-step sign-in asks for a code as well as your password. Get codes from:

  • An authenticator app, like 1Password, Google Authenticator or Authy. You’ll get backup codes too. Keep them somewhere safe.
  • Email, sent to your confirmed address.
  1. Open Settings › Security.
  2. Under Two-step sign-in, choose how you want to get codes and follow the steps.
  3. Save your backup codes if you set up an app.

You can let a browser skip the second step for 30 days, and forget those browsers later from the same card.

A pool owner can make two-step sign-in compulsory for everyone in a pool. Members who haven’t set it up can still sign in, but can’t open that pool until they do.

Passkeys#

A passkey signs you in with your fingerprint, face or device PIN, with no password to type or leak. A passkey counts as two-step sign-in on its own. Add one under Passkeys on each device you use.

App lock#

The app lock asks for Face ID or your fingerprint every time you open Budget Smugglers on a device, and again after it’s been left alone for a while. Handy on a shared tablet. It uses a passkey, and turning it on sets one up if there isn’t one on that device yet.

Signing in with your phone#

On a computer, you can sign in by approving it on your phone instead of typing your password. Your phone needs to be signed in already.

Sessions#

Active sessions lists every browser that’s signed in, with roughly where and when. Sign any of them out, or all the others at once. Sessions last 30 days unless you sign out.

Security alerts#

You’ll get an email when:

  • someone signs in from a new device
  • your password is changed or reset
  • two-step sign-in is turned on or off, or new backup codes are made
  • a passkey is added or removed
  • an API token is made, or an app is connected to your account
  • your data is downloaded

These can’t be switched off. They’re how you find out if something’s wrong.