Account & security

ZeroDrop has several independent ways to secure your account and to automate it. They are all on the account pages of the console.

Password

ZeroDrop stores your password only as a strong one-way hash, so it can never read the password back. You can change the password at any time on the Settings page. ZeroDrop asks for your current password first.

If you lose access, select Forgot password on the sign-in screen. ZeroDrop emails a single-use reset link with a time limit. Sign-in and reset have rate limits and equalized timing, so the system never reveals whether an email address has an account.

Signing in with Google or GitHub

You can sign up and sign in with Google or GitHub instead of a password. The buttons are on the sign-up screen and on the sign-in screen.

The first time you use a provider, ZeroDrop creates your account from the verified email of that provider. There is no separate confirmation step. After that, the same button signs you in. If you already have a password account and then use a provider with the same email, ZeroDrop links the two into one account. You can then sign in with either method.

An account from a provider has no password to change. The Settings page therefore shows a set up a password option instead of the usual change form. ZeroDrop emails a link that takes you through the reset flow and sets a first password. You can then sign in with either method. You can also add two-factor authentication or a passkey to the account.

Two-factor authentication (TOTP)

Turn on two-factor authentication to require a six-digit code in addition to your password. The code comes from an authenticator app, for example Google Authenticator, 1Password or Authy.

1. Open the Two-factor page and scan the QR code into your app.
2. Enter a code to complete the pairing.
3. Store your recovery information in a safe place.

Sign-in then asks for a new code each time. ZeroDrop throttles repeated wrong codes.

Passkeys

A passkey signs you in with the biometrics of your device or with a security key. There is no password, and there is nothing to phish. ZeroDrop supports passkeys through WebAuthn.

• Add one or more passkeys on the Passkeys page. A passkey can be a laptop fingerprint reader, a phone, or a hardware key. Add several passkeys, so you cannot be locked out.
• To sign in later, select passkey and approve the prompt.

API tokens

An API token lets scripts and tools manage your checks over the HTTP API without your password. A token has the same access as your account.

• Create a token on the API tokens page. ZeroDrop shows the raw token one time only, so copy it immediately. ZeroDrop stores only a hash and cannot show the token again.
• Send the token as a bearer token: Authorization: Bearer <token>.
• Revoke a token at any time to stop its access immediately.

CAUTION: A token is a bearer credential. Treat a token like a password. Keep tokens out of source control. If a token was exposed, revoke it and create a new one.

The API reference documents the API. Use the API to manage your checks as code: declare the set of checks that you want, and apply it idempotently. API examples has two complete Python scripts. One script syncs your checks. The other renders a private dashboard.

How ZeroDrop protects your session

• ZeroDrop stores session and token secrets only as hashes, never as plaintext.
• Mutating requests from the browser have protection against cross-site request forgery (CSRF). Requests with a bearer token are exempt, because they do not use your cookies.
• ZeroDrop encrypts sensitive secrets, such as your two-factor key, at rest.

You do not configure any of this protection. It is on by default.