Sign-in, passwords and account security

Passwords need at least 10 characters. A long passphrase or a password manager's random password is the best choice. FastPing stores only a salted scrypt hash of your password, never the password itself, so nobody at FastPing can tell you what it is.

Change it under Settings → Change password. Changing it signs out every other session, which is also how you end sessions on devices you no longer use.

Use Forgot your password? on the login page. If an account exists for the address, we email a reset link valid for 2 hours. Setting a new password with it signs out all existing sessions and signs you in.

After you log in, you stay signed in on that browser for 30 days unless you log out. The session cookie is HttpOnly and only its hash is stored on our side. Under Settings you can sign out of every other session at once. Login attempts are rate-limited per network address, and password confirmations inside the dashboard are limited per account, to slow down password guessing.

We email you when your password is changed or set, and when Google sign-in is connected to or disconnected from your account, so you notice a change you did not make.

You can sign up and log in with your Google account. FastPing receives your name and email address from Google and only accepts addresses that Google has verified. A new account is created only after you accept the Terms, and it needs no password. Your Google account's own protections, such as 2-Step Verification, then guard your FastPing login.

• You already have a FastPing account with the same address: if you confirmed that address and it is a Gmail or Google Workspace address, signing in with Google connects Google to the account and we email you a security notice. Otherwise the connection is refused: log in with your password (or reset it) first, then connect Google under Settings → Sign-in methods.
• A Google account can be connected to one FastPing account only.
• Team invitations can be accepted with Google when the Google account's address is the invited address.
• Accounts created with Google can add a password under Settings to sign in with either method. Google can only be disconnected once a password is set, so you can never lock yourself out.

New accounts receive a confirmation link valid for 72 hours. Until the address is confirmed, the dashboard shows a reminder with a button to send the link again.

1. Change your password: this signs out every other session.
2. Under Settings → Sign-in methods, disconnect a Google account you do not recognise (this also signs out your other sessions). Changing the password does not remove a Google connection.
3. Under API keys, delete keys you do not recognise or that may have leaked, and create new ones.
4. Check Alert channels and Team for entries you did not add.
5. Tell us through the contact form so we can help investigate.