Skip to main content
Lynkz protects your dashboard with a PIN instead of a traditional email and password combination. When you create a page, you choose a PIN that gates all dashboard access — no account registration or email address is required to get started. This page explains how that PIN is stored and verified, how the lockout policy works, and how to set up a recovery path before you ever need it.

​
How PIN Authentication Works

Your PIN is never stored in plain text. When you set or change your PIN, Lynkz hashes it using SHA-256 with a salt before saving it. The raw PIN is discarded immediately and never stored anywhere. All PIN validation runs server-side inside Vercel serverless functions. This means:
  • The PIN hash is never sent to the browser.
  • Validation happens in a secure server environment, not in client-side JavaScript.
  • Your Firebase credentials and all related secrets remain server-only.
The Firebase client SDK that runs in your browser handles dashboard reads and writes, but Firestore security rules prevent it from ever reading or writing your PIN hash directly.

​
Lockout Policy

To protect against brute-force attempts, Lynkz enforces an IP-based lockout:
  • 3 failed login attempts from the same IP address trigger an automatic lockout.
  • The lockout lasts 24 hours.
  • Lockout records are managed exclusively by server functions — clients have no read or write access.
If your IP is locked out, you must wait 24 hours for the lockout to expire before trying again. If you manage your own Lynkz deployment, you can manually remove the lockout record from the Firebase Console to restore access immediately.

​
Choosing a Strong PIN

  • Use a unique PIN — don’t reuse a PIN from another service or device.
  • Write it down somewhere safe — Lynkz has no account recovery unless you’ve set a recovery email. A forgotten PIN without a recovery email means permanent loss of dashboard access.
  • Avoid obvious sequences — patterns like 1234 or 0000 are easy to guess.
Set a recovery email in Settings → PIN recovery email so you can use “Forgot PIN?” if you ever lose access. This takes only a moment and is the only built-in recovery path available.

​
Setting a Recovery Email

In your dashboard, navigate to Settings → PIN recovery email and enter an email address you control. Once saved, this email enables magic link recovery — if you forget your PIN, Lynkz can send a one-time login link to that address so you can regain access and set a new PIN. Your recovery email is stored securely and is never exposed to clients. See Magic Link Recovery for full details on how the recovery flow works.