What your sign-in holds
In plain wordsTechnical detail
| Stored in | Details | Why | Kept for | Schedule row |
|---|---|---|---|---|
| recovery_codes | code_hash | Getting back in when the device a passkey is on is lost. Only a scrambled copy of each code is kept. | Until used, replaced by a new set, or the account is erased. | Not listed yet |
| settings | value_json | Under the key auth.devices: scrambled names of the last few browsers the account was used from, so a sign-in from a new one can be noticed. Under the key auth.passkey_later: the day until which the suggestion to add a passkey is not shown again, set when you choose Maybe later or carry on without a passkey while joining. | The last eight browsers; the day is 30 days ahead and is not read after it passes. Removed when the account is erased. | Not listed yet |
| auth_two_step | method, secret, last_step, failed, locked_until, reset_after, enabled_at | Two-step sign-in, when you turn it on: which kind, and for an authenticator app its secret, kept sealed so a copy of the database cannot read it. Counts wrong codes to pause it after five. | Until you turn it off or the account is erased. | Not listed yet |
| auth_password | hash, salt, iterations, how, set_at, rehashed_at, last_ok_at | A password, if you choose to have one: kept as a salted hash that cannot be turned back into the password and cannot be attacked without the site's own secret. A one-time code by email and a passkey always work as well. | Until you remove it or the account is erased. | Not listed yet |
| auth_password_tries | failed, window_start, lock_level, locked_until, last_lock_at | How many wrong passwords were typed for your account and how long password sign-in is paused, so that guessing is slow. Counts and times only; nothing that was typed. | Cleared by the next right password or a new one; removed when the account is erased. | Not listed yet |
| signup_refusals | email_hash, reason | A scrambled copy of an address that was turned away at sign-up, or that asked to be counted as waiting at a college that is not open yet. | 30 days for a refusal; up to a year for someone waiting. | Not listed yet |