#Sign-in and your account

KopiaLens can ask for a username and password before anyone opens it. Turn this on whenever other people or devices can reach KopiaLens, for example on a home server or in Docker.

Your KopiaLens password is separate from your repository password. The repository password belongs to kopia and unlocks your backups. The KopiaLens password only protects KopiaLens.

#Create an account

Open Settings → Account and select Create account…. Choose a username (admin is suggested) and a password of at least 8 characters. Sign-in turns on straight away, and the browser you used stays signed in.

#First-time setup on a server

When KopiaLens runs as a server (Docker, or any install other than the desktop app) and no account exists yet, anyone who can reach it could create one. To prevent that, setup is open for 30 minutes after KopiaLens starts. After that, creating the account asks for a setup code.

The setup code is printed when KopiaLens starts. With Docker, find it with:

docker logs <container-name>

Look for the line that starts with KopiaLens: Setup is open. Restarting KopiaLens also reopens setup for another 30 minutes. The desktop app only accepts connections from the same computer, so it never asks for a code.

To create the account without the browser, set KOPIALENS_PASSWORD (and optionally KOPIALENS_USERNAME) in the environment before the first start. KopiaLens uses them only when no account exists yet.

#Sign in

The sign-in page asks for your username and password.

• Keep me signed in: when ticked, the browser stays signed in for the time set in Settings → Account → Stay signed in for (30 days by default). When unticked, you're signed out when the browser closes.
• If your KopiaLens password also unlocks encryption and the index is locked, the button reads Sign in and unlock and does both. See Encryption.

In the desktop app you can skip the sign-in page: turn on Settings → Desktop app → Sign in automatically. Only the app's own window is signed in; browsers still ask for the password.

After several wrong passwords, KopiaLens makes you wait a little longer before each new attempt, up to 30 seconds. It never locks the account.

#Manage your account

All of these are in Settings → Account.

Setting	What it does
Sign-in	Turns the password requirement on or off. Turning it off keeps your account, so you can turn it back on without a new password.
Username	Changes the name you sign in with. This browser stays signed in.
Password	Changes your password. If the same password also unlocks encryption, both change together, and the dialog says so before you confirm.
This browser	Signs out this browser.
Other devices	Signs out every browser, including this one. Use it if a device is lost or you signed in somewhere you shouldn't have.
Stay signed in for	How long "Keep me signed in" lasts: 1 day to 1 year. A shorter time also signs out browsers that signed in longer ago.

Changing your password also signs out every other browser.

#Forgot your password

On the sign-in page, select Forgot password?.

• With a recovery key. If your KopiaLens password also unlocks encryption, enter your recovery key and a new password. The new password replaces the old one for both signing in and encryption, and you're signed in.

• On the computer running KopiaLens. Anyone with access to that computer can set a new password:

  kopialens --reset-password
  

  When running from source, use python main.py --reset-password. KopiaLens can keep running while you do this. If your password also unlocked encryption, the encryption password stays as it was and becomes a separate password. You can join them again in Settings → Encryption.