You cannot sign in
- Check the email address, including which one you signed up with if you have more than one.
- Use “Forgot password?”. You get back “If an account exists with this email, a reset link will be sent”, whether or not the address is registered. That is deliberate: it stops anyone using the form to discover who has an account. So the message is not a confirmation, and it does not mean the email is on its way.
- If you set up a passkey, choose Sign in with a passkey instead. If the device or browser does not support it you will be told so plainly.
- If you turned on two-factor, you are asked for the 6-digit code from your authenticator app. A backup code works in that same box, which is the way back in when the phone with the authenticator is lost.
Your account is locked
10 wrong passwords inside 15 minutes locks sign-in. The lock lasts until that 15-minute window closes, counted from the first failed attempt rather than the last, so it is never more than 15 minutes.
While locked, even the correct password is refused. That is intentional, so trying harder is not the answer.
Completing a password reset lifts the lock immediately. If you do not want to wait, that is the fast route.
The verification email
Your verification email contains both a link and a 6-digit code, so if the link misbehaves in your mail client you can type the code into Finthy instead.
The link expires after 24 hours.
What the different messages mean:
- “Verification Link Outdated”: you opened an older email. Open the most recent one we sent, or request a new one.
- “Verification Link Expired”: past 24 hours. Request a new email.
- “Verification Failed”: invalid, or already used. If you have already verified, just sign in.
- “Login Required”: verification is tied to your account, so sign in first and verify from there.
Resend Verification Email is the button, and it sits inside your account rather than on the sign-in page. There is a short countdown between sends, shown as “Resend available in {seconds}s”, which stops a mail provider treating a burst as spam.
If it has not arrived: check spam and promotions, and allow mail from
[email protected]. Also check the address itself for a typo, which is the cause we
see most and which no amount of resending will fix.
A code is rejected
- “That code is not right”: a digit is off, or you are reading an older email.
- “That code can no longer be used”: the code belonged to a superseded email. Send a new one and use the new code. Each resend invalidates the code before it.
Changing your email address
A change is confirmed from the new address before it takes effect, and it can be cancelled until then. Until you confirm, your old address is still the one you sign in with.