> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lynkz.elipseday.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# PIN Authentication and Dashboard Security in Lynkz

> Learn how Lynkz protects your dashboard with a SHA-256 hashed PIN, IP-based lockout after 3 failed attempts, and optional recovery email setup.

Lynkz protects your dashboard with a PIN instead of a traditional email and password combination. When you create a page, you choose a PIN that gates all dashboard access — no account registration or email address is required to get started. This page explains how that PIN is stored and verified, how the lockout policy works, and how to set up a recovery path before you ever need it.

## How PIN Authentication Works

Your PIN is never stored in plain text. When you set or change your PIN, Lynkz hashes it using **SHA-256 with a salt** before saving it. The raw PIN is discarded immediately and never stored anywhere.

All PIN validation runs **server-side** inside Vercel serverless functions. This means:

* The PIN hash is never sent to the browser.
* Validation happens in a secure server environment, not in client-side JavaScript.
* Your Firebase credentials and all related secrets remain server-only.

The Firebase client SDK that runs in your browser handles dashboard reads and writes, but Firestore security rules prevent it from ever reading or writing your PIN hash directly.

## Lockout Policy

To protect against brute-force attempts, Lynkz enforces an IP-based lockout:

* **3 failed login attempts** from the same IP address trigger an automatic lockout.
* The lockout lasts **24 hours**.
* Lockout records are managed exclusively by server functions — clients have no read or write access.

<Warning>
  If your IP is locked out, you must wait 24 hours for the lockout to expire before trying again. If you manage your own Lynkz deployment, you can manually remove the lockout record from the Firebase Console to restore access immediately.
</Warning>

## Choosing a Strong PIN

* **Use a unique PIN** — don't reuse a PIN from another service or device.
* **Write it down somewhere safe** — Lynkz has no account recovery unless you've set a recovery email. A forgotten PIN without a recovery email means permanent loss of dashboard access.
* **Avoid obvious sequences** — patterns like `1234` or `0000` are easy to guess.

<Tip>
  Set a recovery email in **Settings → PIN recovery email** so you can use "Forgot PIN?" if you ever lose access. This takes only a moment and is the only built-in recovery path available.
</Tip>

## Setting a Recovery Email

In your dashboard, navigate to **Settings → PIN recovery email** and enter an email address you control. Once saved, this email enables magic link recovery — if you forget your PIN, Lynkz can send a one-time login link to that address so you can regain access and set a new PIN.

Your recovery email is stored securely and is never exposed to clients. See [Magic Link Recovery](/security/magic-link-recovery) for full details on how the recovery flow works.