Account and sign-in reference

These are the rules the Moraph Portal applies to client accounts. Your organization’s agreement with Moraph may add its own requirements.

Time limits

Passwords

• At least 12 and at most 200 characters.
• Can’t contain the part of your email address before the @ (when that part is 5 characters or more).
• Can’t start with “password” or “moraph”, or be one character repeated.
• Stored only as a salted PBKDF2-SHA256 hash, never in readable form.

Protection against guessing

• 8 wrong passwords in a row lock the account for 15 minutes, and we email you.
• 20 failed sign-ins from one network within 15 minutes pause sign-in from that network for 15 minutes.
• 10 wrong two-step codes from one network within 15 minutes pause two-step sign-in for 15 minutes.
• Sign-in and reset pages give the same answer whether or not an email has an account.

Two-step verification

• Time-based 6-digit codes (TOTP, 30-second steps), from any standard authenticator app.
• A code can’t be used twice.
• 10 single-use recovery codes, shown once; making new ones cancels the old ones.
• The secret behind your codes is encrypted when stored.

Emails we always send

You always get an email when your password is changed or reset, your account is locked, two-step verification is turned on or off, a recovery code is used, or someone tries to create an account with your address.