What is ACT?
ACT stands for Account Content Token. It's the credential
that keeps you signed in to your account between visits, without asking you to re-enter your
password every time.
Think of it like a hotel key card: once you've checked in (logged in with your password — and
your 2FA code if you have it enabled), you get a card that lets you back into your room
without going to the front desk again. The card only works for your room, it expires after a
set period, and if you ever need to, changing your password cancels every card that was ever
issued to you.
An ACT is tied to your account, not to any single device. Every device you sign into
the same account with uses the same ACT — so seeing the same ACT on all of your browsers is
normal and expected. It's the separate TAM check below that proves a request is actually
coming from one of your trusted devices.
What is TAM?
TAM stands for Trusted Account Module — the system that
ties your account to the specific device you're signing in from. A key card can be copied.
In the same way, if an ACT were ever intercepted — through a compromised browser
extension, a malicious script, or a leaked log — it alone would let someone act as you.
TAM closes that gap.
When you first sign in on a device, TAM has that device generate a cryptographic key pair
of its own. The private half is created in a way that makes it non-exportable: your browser
can use it to sign — proving "this is the same device that registered" — but nothing, not a
script running on the page, not a browser extension, not even you looking through developer
tools, can ever read the key's raw contents out of the browser. Only the matching public
half is sent to us and stored on your account.
From that point on, signing in requires two things together: a valid ACT and proof from
that specific device's TAM key. Stealing the ACT alone is no longer sufficient.
TAM keys are stored per device, and each one is valid for 14 days. When a key expires,
the device is asked to sign in again with your password, and a fresh key is issued. If a
new device is ever added to your account, we send a confirmation email to your account's
address before that device is trusted.
What is CAT?
CAT stands for Challenge Account Token — the short-lived
challenge the Trusted Account Module issues when a device needs to prove it still holds the
key it registered.
Each CAT is generated fresh by us, is valid for only 120 seconds, and is cryptographically
sealed so it can't be forged, altered, or reused for a different account. Your browser never
invents it — it only ever comes from us. To complete a sign-in, the device signs the CAT
with its private TAM key and sends back only the signature.
Because a CAT only works for the brief window it takes to verify a signature, a stolen or
intercepted CAT on its own is worthless.
How TAM Verifies a Sign-In
-
1. Token check
Your browser presents its ACT. We confirm it's genuine and hasn't expired.
-
2. CAT issued
The Trusted Account Module generates a short-lived Challenge Account Token
(CAT), valid for 120 seconds, and sends it to your browser. Your browser never
invents it itself — it always comes from us, and it's cryptographically sealed so
it can't be altered or reused for a different account.
-
3. Device proof
Your browser signs that CAT using its private TAM key — the key that never
leaves the device — and sends back only the signature.
-
4. Session granted
We verify both the CAT's authenticity and its signature against the TAM
public key on file for your device. Only then is your session actually created.
If the signature is missing, doesn't match, or the CAT has expired,
sign-in is refused, even with a valid ACT.
The CAT is sealed with a
server-held key using authenticated encryption, so it can't be forged, decoded, or
edited by anyone without that key — and it stops working entirely once its 120-second
window closes.
How Your Account Is Protected
Your ACT is generated only after you've successfully logged in with your password (and your
2FA code, if enabled). It is uniquely bound to your account — it cannot be reused on another
account, and it cannot be reverse-engineered to reveal your password.
Every ACT carries a built-in expiration. Once that window passes, the token stops working on
its own, and you'll simply be asked to sign in again. If you change your password, every
previously issued token is automatically invalidated, so a token from before the change can
no longer be used.
And on any device that has registered a key, a valid ACT is not enough on its own — a fresh
TAM device signature is required alongside it. Together they mean that both your identity
and your trusted device must be confirmed.
We intentionally don't publish the internal mechanics of how ACT or TAM are constructed or
verified — that's part of what keeps them safe from being forged or tampered with. What
matters for you is the outcome: only a token that was legitimately issued to your account,
that hasn't expired, that hasn't been invalidated by a password change, and that is backed
by a valid TAM device signature will ever work.
Instant Re-login
"Instant re-login" is the everyday benefit of holding a valid ACT plus a registered device
key: when you come back to an app or site, your device presents both and you're back in
immediately — no typing, no waiting on a fresh login screen.
-
Fast
Your session resumes right away instead of requiring you to sign in again.
-
Scoped
An ACT only ever works for the one account it was issued to — and the same ACT is
shared by every device on that account. A device key only ever works for the one
device it was generated on.
-
Revocable
Changing your password invalidates every previously issued token, signing out
removes your sign-in from that browser, and a token that has expired stops working
on its own.
Managing Your Trusted Devices (Account Administration)
The Account Administration page (under Account Settings) gives you a live
view of every trusted device signed into your account. For each device you can see its
device ID, whether its TAM key is currently trusted, where it last signed in, its last
IP address, when it was registered, and when its trusted-device key expires.
-
Sign out a single device
Removes that device's TAM key from your account. The device can no longer use its
stored sign-in — it will be asked for your password (and 2FA code, if enabled)
before it can access your account again.
-
Sign out all devices
Removes every TAM key on the account at once. Every device, including the one you're
using now, must sign in again with your password and 2FA before it can continue.
Because a trusted-device key is what keeps a stolen credential from
being enough to access your account, signing a device out immediately stops that device from
authenticating — no waiting, no expiry window.
Sign-out Notifications
Whenever a trusted device is signed out — by you or by anyone with access to your account — we
email the security address on your account. The notification tells you which device was signed
out, where it last signed in, and what to do next.
-
If it was you
Nothing to do. The device is signed out and the message can simply be disregarded.
-
If it wasn't you
Click "This wasn't me" in the email. We immediately invalidate every
trusted device and active session on your account and lock the account so nobody — not
even the person who signed the device out — can keep using it.
Account Recovery After an Unfamiliar Sign-out
When you click "This wasn't me", a recovery email is sent to your security
address that walks you through securing the account again:
-
1. Reset your password
Choose a new, strong password. Every previously issued token is invalidated the moment
the new password takes effect.
-
2. Set up a new two-factor method
Configure a fresh authenticator (TOTP) key or email verification before unlocking, so
the account is protected again the moment it's back online.
-
3. Unlock and sign in
Click "Unlock My Account", go through the unlock page, and then sign in
manually with your new password. From there, re-register your trusted devices.
Keeping Your Account Safe
A few simple habits go a long way alongside the protections built into ACT and TAM:
Use a strong, unique password — your ACT is only as safe as the password that
originally created it.
Enable two-factor authentication (2FA) — this adds a second check at
sign-in, so your password alone isn't enough to reach your account.
Sign out devices you don't use — use Account Administration to sign a device
out and remove its trusted-device key entirely. That device will need your password (and your
2FA code, if enabled) before it can access your account again.
Change your password if anything looks unfamiliar — doing so immediately
invalidates every previously issued token, including any that may have been copied.
New device sign-ins require TAM setup — signing in from a new browser
triggers a one-time device key registration step. This is expected and is part of what
protects your account.
Clearing browser data resets your device key — because the private key can't
be exported or backed up, clearing site data means that browser will register a new device
key on next sign-in.
Security Starts With You
ACT, TAM, and CAT work together to make signing in from any of your devices fast and
secure — so you can move freely between your phone, tablet, and computer without being
asked to prove who you are on every visit. But this system is built around credentials,
and credentials are only ever as secure as the person holding them.
Consider what a genuine sign-in means: the moment someone logs in as you, they are issued a
working ACT, their device registers a TAM key of its own, and every CAT challenge that
follows works for them. From that point on, their device is simply another trusted device
on your account. All the protections described here defend against stolen or
forged credentials — none of them can distinguish you from someone who has
legitimately signed in with your password and your codes.
That is why your own habits are the most important safeguard of all. No amount of
server-side security makes up for a weak, reused, or shared password — and the single
strongest step you can take is enabling two-factor authentication. With 2FA on, even a
compromised password is not enough on its own to sign in.
The short version: we make your credentials safe to hold, but you make them
safe to keep. Use a strong, unique password, enable 2FA, log out of devices you don't use,
and stay alert to anything unfamiliar on your account.