Account security

Your password, two-factor authentication, passkeys and the devices you are signed in on.

All of it is in Settings -> Security, which is personal and has no team context. Two tabs:

Sign-in - what proves you are you: your password, two-factor authentication and your passkeys. Account protection at the top says what the account currently carries and what is worth doing next.
Devices - where that proof is being held right now.

How it works

Passwords are hashed with scrypt, and the cost is stored inside each hash, so raising it later re-hashes people in place on their next sign-in rather than locking anybody out.

Every password a person chooses is checked against Have I Been Pwned, using the k-anonymous range API: a prefix of the hash leaves this instance, never the password. The check fails open, so an instance with no outbound access still works. It runs on account creation, password changes, admin resets, HTTP basic auth credentials, the Traefik dashboard password and a database engine password.

A password Deplo generates for you is exempt, since it is random by construction.

Change your password

Settings -> Security -> Password, then Change password. You enter the current one, then the new one. It is checked for length, character mix and breach exposure before it is accepted.

Changing it does not sign out your other devices. Do that deliberately with Sign out everywhere else.

Two-factor authentication

Settings -> Security, then Turn on two-factor authentication. Four steps:

Confirm it's you

Enter your password. You need an authenticator app on your phone for the next step: 1Password, Bitwarden, Google Authenticator and Aegis all work.

Scan the QR code

Scan the QR code with the app, or type the TOTP setup key in by hand - your app may call it the secret or the setup code. Click I have scanned it.

Enter the code

Enter the six-digit code the app shows, then Turn on. It changes every 30 seconds; if one is rejected, wait for the next.

Save the recovery codes

Save the recovery codes. Copy or Download them, then confirm I have saved my recovery codes somewhere safe. They are your way in when the phone is not.

At sign-in you then get a second screen taking either the six-digit code or a recovery code in xxxxx-xxxxx form.

Turn off removes it, unless a team or a role you hold requires it.

Passkeys

Beta. A passkey is a full sign-in method, not a second step: Sign in with a passkey replaces the password entirely, and a session that presented one satisfies a two-factor requirement.

Add passkey asks for your current password first.
Rename does not.
Remove asks again.

Each one shows what is holding it, as the authenticator reported it, not as you named it:

Type	What it means
Synced	Copied into a keychain, so it follows you between your devices.
This device	Lives only on the machine you registered it on.
Security key	A physical key you plug in or tap - USB, NFC or Bluetooth.

A passkey is bound to the hostname you registered it on. If the panel moves to a different address, every passkey shows Not usable here and the password still signs you in, so you can register a new one. This is how the standard works and cannot be worked around.

Devices

The Devices tab puts the browser you are reading this in at the top, then lists every other one under Other devices with its address and when it was last seen. Each row carries the mark of the browser and the operating system, so an entry you do not recognise stands out.

Sign out ends one. Sign out everywhere else ends all but the one you are using, which is the right button after losing a laptop.

When your team requires two-factor

A team, or a role inside it, can require it. If you have not enrolled, that team shows a lock screen instead of the dashboard, offering to turn it on, switch to another team, or sign out.

The requirement is total while it is unmet: you resolve nothing in that team through the interface, through the API, or through any token you created.

Limits and gotchas

Recovery codes are shown once.
A password change does not revoke sessions. Use Sign out everywhere else.
External credentials are not breach-checked (registry, SMTP, S3, git tokens). Deplo cannot rotate them, so a hit would only break a working integration.
Losing both the authenticator and the recovery codes means an instance admin has to reset your account.

If it does not work

The six-digit code is rejected: the phone's clock has drifted. TOTP is time-based.
Passkeys all say Not usable here: the panel is on a different hostname than when you registered them. Sign in with your password and add a new one.
You are locked out of a team: it requires two-factor. Enrol from the lock screen.

See Sign-in and access for more.