Account security on blitz.cloud - passkeys, 2FA and sessions

You can sign in to blitz.cloud with an email address and password, with GitHub, or with Google. From Settings you can add passkeys, turn on two-step verification with an authenticator app, and sign out any device the account is signed in on.

Signing up and in

Sign-in runs on login.blitz.cloud, our own Keycloak server in the same German data centre as everything else. No third-party login service sits in between unless you choose GitHub or Google.

• Passwords must be at least 10 characters.
• Email signups have to confirm their address before creating apps or databases.
• Repeated failed sign-ins slow down and then lock the account for a while, to stop password guessing.
• Throwaway email providers are refused at signup.

Passkeys

Add a passkey in Settings under sign-in and security, and give it a name so you can tell them apart later. The sign-in page offers the passkey your browser or phone already has, so you don't type anything.

Two-step verification

Turn on two-step verification in Settings and scan the code with an authenticator app that supports TOTP, such as Aegis, 2FAS, 1Password or Google Authenticator. From then on, signing in with a password also asks for the six-digit code.

Sessions

Settings lists every device the account is signed in on. You can sign out a single device, or every device except the one you're using.

Linking GitHub or Google

You can add GitHub or Google as another way to sign in to an existing account. If the account has no password, linking asks you to confirm with the provider you already use.

What we don't see

Password changes, passkey setup and two-step verification happen on the sign-in server's own pages. The dashboard never handles your password or your authenticator secret.

Deleting your account

A delete button in Settings isn't built yet. Write to hallo@blitzworks.io from the account's email address and we delete the account and everything in it.