DueNorth
Sign in
Your password is turned into keys in this browser. It is never sent to the server.
No account? Create one
Forgotten your password? Use your recovery phrase
Recover your account
Your recovery phrase can unlock your data when your password cannot. Nothing on our server can, which is why this is the only way back. You will still need your authenticator to sign in afterwards.
Create an account
Deriving your keys takes a moment — that cost is what protects a weak password.
If you forget this password, your budget data cannot be recovered by us or by anyone else. That is the point of the design, and it is not reversible.
Already have an account? Sign in
Choose your second factor
Every account needs one. Your password alone is not enough to sign in.
Are you sure?
With no second factor, your password is the only thing protecting your data.
In most applications a leaked password means someone can sign in until you change it. Here it means more than that: your password derives the key that decrypts everything you store. Someone who has it can read your data directly, and changing the password afterwards does not take that back.
This matters most if you have ever used this password anywhere else. Breach dumps are how these attacks start.
Set up your authenticator
A second factor is required for every account.
Scan this with your authenticator app — Google Authenticator, Authy, 1Password, Bitwarden, Aegis, or any other.
Or enter this key by hand:
Save your recovery codes
If you lose your authenticator, one of these gets you back in. Each works once.
This is the only time these are shown. They are stored hashed, so we cannot show them again or send them to you. If you lose your authenticator and these codes, your account and its data are gone permanently — there is no reset we can perform.
Set a PIN
Optional. A PIN reopens this tab after it locks, without re-deriving your keys.
It only works in this tab, while your keys are still in memory. Reloading the page or reopening the browser needs your password again — a four-digit PIN cannot stand in for it.
Signed in
Session established. There is no application behind this yet — the worksheet arrives at phase 5.
Trusted devices
No devices are skipping the code.
DueNorth