Security overview
What actually protects your account today, in one place. This page is an additional look at security specifically — the same real controls also live in Settings → Security. Baseline security (password hashing, lockouts, session expiry) is always on and can't be turned off from either place.
Full manual
Every Fomoji feature, documented.
Authentication methods
What you can currently sign in with.
Username / email + password
Hashed server-side with scrypt, never stored or sent in plain text. Repeated failed attempts trigger a temporary lockout on that identifier.
Passkeys
Real server-side WebAuthn — Face ID, Touch ID, Windows Hello, or a security key. Manage yours from the passkey page.
Two-factor authentication (2FA)
Not built yet as a separate step — a passkey already provides device-bound, phishing-resistant verification on its own.
Fomoji Authentication Card
Your account's signed identity card — full account info, a unique server-generated pattern, and a signature only Fomoji could have issued.
View / download your card
Requires a fresh device unlock (passkey, password, or PIN) — separate from just being signed in.
Card unlock PIN
An optional quick-unlock secret for the card, separate from your account password.
What "verified" means here: a download carries the card's actual signed data, so it checks out against Fomoji's server. A screenshot only carries pixels — it has nothing to verify, even though it looks identical. No website can detect or block a screenshot itself; what this buys you is that nobody can forge a card that verifies, not that screenshots are prevented.
Session
Trusted devices, sessions, and signing out.
Current session
—
Trusted devices
Not built — everything here lives per-browser with no server, so there's no cross-device list to show yet. Signing in elsewhere just starts an independent session there.
Sign out of Fomoji
Ends this session on this browser.
Change password
Requires your current password.
Connected applications & permissions
What can sign in as you.
CAT
Coding agent terminal. Authorizing this only verifies your identity — it never shares your password, and it doesn't grant CAT any access to your device.
Not connected
Full connector manager
Per-app permissions, every connected application, and approving a connection code from CAT or another project.
Data protection & privacy
Where your data actually lives.
Storage
Your identity, credentials (password hash, passkeys), and sign-in activity live server-side in a real database. Appearance, tab bar, gestures, and connected-app state still live only in this browser's local storage — those haven't moved to the server yet.
Full privacy policy
Includes how third-party AI providers would be handled once that layer exists.
Recovery
Your one-time recovery code is the only backup door this build has.
Reset with recovery code
Available from the login screen's "Forgot password?" link. Resetting rotates your code automatically.
No email-based reset exists — that needs a mail server this build doesn't have. If you lose both your password and your recovery code, there's currently no way back into that account.
Security recommendations
Realistic advice for what this build actually protects.
Store your recovery code somewhere durable and offline — it's shown exactly once and can't be retrieved again.
Use a password you don't reuse elsewhere — hashing protects it locally, but it's still the only thing standing between anyone with browser access and your account.
Sign out on shared or public computers — sessions persist by default until you do.