PIN Access & Security
How the 4-digit PIN system works, including lockouts, sessions, and revoking access.
PIN entry
When a client opens their unique portal link for the first time (or after their session expires), they see a PIN entry screen with four individual digit boxes. They enter the 4-digit PIN sent in their invitation email. The PIN can be typed digit by digit — focus advances automatically — or pasted directly into the first box.
How PINs are generated and stored
QWTN generates a random 4-digit PIN when you invite a client. The PIN is emailed to the client in plain text so they can log in, but is never stored in plain text on the server. It is hashed using scrypt with a random 16-byte salt before storage. Even database access does not reveal the original PIN.
Session management
After a successful PIN entry, a session token is issued and stored as a secure cookie named qwtn_portal_session. The session lasts 7 days. Clients do not need to re-enter their PIN until the session expires or they clear their browser cookies. The portal verifies the session cookie on every request.
Lockout protection
After 5 consecutive failed PIN attempts, the portal account is locked for 15 minutes. During lockout, the client sees a message explaining how long they must wait. The lockout counter resets after a successful login. This prevents brute-force PIN guessing.
Revoking access
You can permanently revoke a client's portal access from the Client Detail page using the Send / Manage Portal Access panel. Revocation invalidates the access token immediately — any open portal session will be rejected on the next page request. You can re-invite the same client at any time, which generates a new token and PIN.