Sign-in and security: your password, the emailed code, and remembered devices

Signing in

You sign in with your email address and password. The first time you sign in on a device Pump House has not seen before, one extra step: we email a 6-digit code to your address. The screen says "new device. we emailed a 6-digit code to your address. enter it below to finish signing in."

1. Enter your email and password as usual.
2. Check your email for the code. It can take a minute, and sometimes lands in junk. The code is single-use and expires in 10 minutes.
3. Type the code in. Leave "remember this device for 30 days (only tick this on your own device)" ticked if the computer or phone is yours. Untick it on a shared or public computer.

Remembered devices

On a remembered device you will not be asked for a code again for about 30 days. Remembering a device only ever skips the code. Your password is required every time, on every device.

Why there is no authenticator app to set up

This is deliberate. The emailed code does the same second-check job (proving it is really you on a new device) without asking you to install or set up anything, and it is only asked for on a device we have not seen before. The code email also acts as an alert: if one arrives when you did not try to sign in, someone may have your password, so ignore the code and reset your password straight away.

Wrong code, or code did not arrive

Only the newest code works. If you type it wrong 5 times the code is locked out for a few minutes; wait about 10 minutes, then sign in again to get a fresh code. If no email arrives, check junk, then try again.

Resetting your password

1. On the sign-in page choose "Reset it".
2. Enter your email. We send a single-use link that expires in 60 minutes.
3. Choose a new password: at least 12 characters, and not one you have used elsewhere. Passwords that have appeared in known data breaches are rejected, that is on purpose.

Setting a new password signs you out of every device and clears every remembered device. That is deliberate: if you ever suspect someone has your password, a reset locks them out everywhere in one step.