Password + recovery
Password rules, account recovery via the forgot-password flow, magic-link fallback, and what happens after you reset a password mid-session.
If you signed up with email + password, this page covers what’s required of your password, how to reset a forgotten one, and what happens when you change it.
Password rules
| Rule | What it means |
|---|---|
| Minimum length | 8 characters |
| Allowed characters | Anything — letters, digits, symbols, spaces, Unicode |
| Maximum length | None enforced (Supabase Auth handles this; practical max is high) |
| Storage | Hashed (bcrypt-equivalent) — sweetdocs never sees your plaintext password after the hashing step |
There’s no upper-cased / lowercased / digit / symbol requirement in v1 — we trust users to pick good passwords. A length-based rule combined with hashing is the most security per friction.
We strongly recommend a unique, ≥16-character passphrase generated by a password manager. The single most effective protection against credential stuffing is to never reuse a password.
Forgot your password?
- Sign-in page → Forgot password?
- Enter your email
- Click Send reset link
- Check your inbox for a Supabase Auth email
- Click the link → land on the reset page
- Type a new password (twice, to confirm) → submit
The reset link has a short validity window (~1 hour) and is single-use.
If you don’t receive the email within a few minutes, check spam and verify the email address you typed. If still nothing, contact support.
Magic link as recovery
The forgot-password flow has a passwordless variant — instead of resetting your password, you can request a one-time magic link that signs you in directly without changing anything.
This is useful when:
- You don’t remember your password but don’t want to reset it (maybe you typed it wrong)
- You don’t want to invent a new password right now
- You’re on a device you don’t fully trust and don’t want to enter your real password
After signing in via magic link, you can change your password from Settings → Security if you choose.
Changing your password while signed in
Settings → Security → Change password:
- Enter your current password
- Enter the new password
- Confirm the new password
- Submit
You stay signed in on this device. Other devices may be kicked out depending on the Supabase Auth setting (defaults to keeping them signed in — the password change doesn’t auto-revoke existing sessions). To force all other devices off, use Settings → Security → Sign out everywhere after changing. See Sessions + devices.
Lockout and rate-limiting
To slow down brute-force attacks:
- Repeated failed sign-ins from the same IP / account slow down progressively
- A series of failures triggers a cooldown window
- Genuine users see this rarely; if you hit it, wait a minute and try again
Persistent issues — especially if you’re sure your password is correct — usually point at a typo or an account email mismatch.
Two-factor authentication
Two-factor (TOTP) is on the roadmap. Once shipped, you’ll set it up from Settings → Security with an authenticator app (Authy, 1Password, etc.). For orgs needing 2FA today, the closest path is using Google OAuth with Google’s 2FA enabled on the upstream Google account — see Sign-in methods.
When SSO + SCIM ships for Teams orgs, 2FA enforcement is handled by your IdP (Okta, Google Workspace, Azure AD, etc.).
Account takeover defense
A few defaults that protect you:
| Defense | Detail |
|---|---|
| Email change requires double confirmation | Both the old and new email must confirm before the change takes effect (see Sign-in methods) |
| Password storage is hashed | A database breach exposes hashes, not plaintext passwords |
| Sign-out everywhere | Available with one click for the moment you suspect compromise |
| Account deletion is 30-day soft delete | Reversible by signing back in within 30 days if a takeover triggered deletion |
| Auth rate limits | Slow down credential stuffing |
If you ever think your account has been compromised:
- Change your password (forces re-auth)
- Settings → Security → Sign out everywhere
- Check your email for any unexpected confirmation messages
- Contact support if you suspect data exfiltration