Cyberlop never keeps a password in readable form. It hashes local passwords with bcrypt at work factor 12. Local passwords need at least 12 characters with a mix of character classes, and repeated failed sign-ins trigger a rate limit with an escalating lockout.
The short version
Cyberlop turns each local password into a hash with bcrypt at work factor 12. It keeps the hash and nothing else. Nobody can read your password back from that hash, and the app never keeps a copy of the original text anywhere that a person or a script could look it up.
| Protection | What the Security page says |
|---|---|
| Hashing | bcrypt, work factor 12 |
| Minimum length | At least 12 characters with a mix of character classes |
| Guessing limits | Failed logins are rate-limited per client and per username, with escalating lockout |
| Single sign-on | Supported, with MFA delegated to the identity provider |
How it works in Cyberlop
A hash is a one-way fingerprint of the password. When you sign in, Cyberlop hashes what you typed and compares the two fingerprints. The work factor makes each hash slow to compute on purpose, which slows down anyone who tries millions of guesses against stolen data.
The same page sets the rules for new passwords. A local password needs 12 or more characters with mixed character classes, so Cyberlop refuses a short or simple choice when you set it.
Guessing at the sign-in screen meets limits too. Cyberlop counts failed logins per client and per username, and the lockout grows with each repeat. A script that tries one password after another soon finds itself shut out.
If your organisation uses single sign-on, your identity provider handles the password step and any second factor, so those rules never touch your day-to-day sign-in. Local password rules then matter only for accounts that still sign in locally.
What to do next
- If a new password fails the rules, read why a local password fails.
- If you see a lockout, read what to do after failed sign-ins.
- To require a second step, see how to require MFA.
The full list of controls sits on the security page.
Related questions
- Why isn't my new password accepted?
- I'm locked out after several failed sign-in attempts. What happened?
- How are sign-in sessions secured?
- How does Cyberlop store my credentials and tokens?
- How do I make two-factor authentication mandatory for my workspace?
Two-factor authentication: require MFA for everyone who signs in
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.