Sessions & sign-in persistence
How Scrydon's sign-in method ladder works, how long you stay signed in, what "Remember me" and "Trust this device" do, and why you might be asked to sign in again.
Sign-in methods
After you enter your email address, Scrydon presents the available sign-in methods in preference order — starting with the most secure:
- Passkey — a device-bound credential (Touch ID, Face ID, Windows Hello, or a hardware security key). No password required; phishing-resistant by design. Recommended for all users.
- Email code — a one-time code sent to your email address. Valid for 15 minutes, and it must be entered in the same browser that requested it (see below).
- Email sign-in link — a one-click link sent to your email address. Opens a session when you follow it.
- Password — a traditional password. Available as a fallback; disclosed last so stronger options are seen first.
You can choose any method available to your account — the order reflects what we recommend, not what you are forced to use. The methods offered are tailored to your account: a passkey only appears if you have one registered, and the email options are not offered on accounts protected by two-factor authentication (see below). Password is always available as a last resort.
Email codes are tied to the browser that requested them
A one-time code only works in the browser where you started signing in. If you request a code on your laptop and try to type it on your phone, it will be rejected — the code is not a password you can carry between devices.
This is deliberate. Because the code is bound to your browser, nobody else can use it, and nobody else's attempts can interfere with yours: someone who knows your email address cannot request codes to "use up" your attempts or invalidate the code sitting in your inbox.
If you want to sign in on a different device from the one holding your inbox, use the email sign-in link instead. The link works from any device.
A few related behaviours:
- Requesting a new code replaces the previous one. Always use the most recent email.
- You get five tries per code. After that, request a new one — this affects only your own sign-in attempt.
- If you request several codes in quick succession, we send one and reuse it, so you are not left guessing which of three emails to open.
Signing in with two-factor authentication
If your account has two-factor authentication (2FA) enabled, the sign-in flow has an extra step:
- Sign in with your passkey or password as usual.
- Enter the 6-digit code from your authenticator app (TOTP). The form submits when you select Verify — there is no time pressure while you type.
Email-channel methods (email code and email sign-in link) are not accepted as a substitute for the authenticator when 2FA is enabled; only passkey or password + authenticator grants a full session.
If you lose access to your authenticator app, use a recovery code — a set of single-use backup codes issued when you first enrolled 2FA. Go to the sign-in page, complete your password step, then choose Use a recovery code on the authenticator screen. Each code can only be used once. Generate new recovery codes in Settings → Security while you still have access to your authenticator.
After 10 consecutive unsuccessful authenticator or recovery-code checks, Scrydon temporarily locks second-factor verification for 15 minutes. Further attempts return a retry-later response (HTTP 429) until the window expires. A successful verification clears the failure counter.
Scrydon uses secure, HTTP-only session cookies. How long a session lasts depends on the choices you make at sign-in.
Session duration
| Sign-in choice | Session lifetime | Survives closing the browser? |
|---|---|---|
| Remember me checked (default) | 30 days, extended while you keep using the platform | Yes |
| Remember me unchecked | 24 hours maximum, not extended | No — ends when the browser fully exits |
With Remember me (the default), your session is valid for 30 days and the expiry slides forward as you use the platform — you stay signed in on that browser until you sign out, are deactivated, or stop using Scrydon for 30 days.
If you untick Remember me, Scrydon issues a stricter session: it ends when your browser fully exits (including mobile browsers being evicted in the background) and expires after at most 24 hours either way. Choose this on shared or public machines.
Single sign-on (SSO), passkey, and magic-link sign-ins always use the 30-day remembered behavior.
Two-factor authentication and "Trust this device"
If your account has two-factor authentication enabled, you enter a 6-digit code from your authenticator app after your password (or passkey). The form submits when you select Verify — take your time; nothing is sent while you type.
Ticking Trust this device before verifying registers the browser as trusted for 30 days: you won't be asked for a second factor on that device during that window. The trust is bound to your account and device and is re-validated server-side on every sign-in.
Why was I signed out?
- You (or an administrator) signed you out or revoked your sessions — for example after deactivation or a password reset.
- You signed in with Remember me unchecked and the browser exited, or the 24-hour limit passed.
- Your session reached the 30-day maximum without activity.
If you are signed out unexpectedly on a corporate device, also check for browser policies that clear cookies on exit.