A forgotten password

A six-digit code good for ten minutes and five attempts (ten wrong ones a day per account), which on use ends every session the account has — and a page that answers every address alike.

A code, not a link

A password reset is a six-digit code that arrives by email and that you type into the page you are already standing on. Not a link, and deliberately so: email is the one part of this procedure Runjet does not control — it is forwarded, quoted in a reply, and a corporate scanner follows every link it sees. A link somebody followed on your behalf is a spent token and a person shut out. A code cannot be followed by accident; somebody has to read it, carry it to the tab and type it. And because the account is identified by the address in the form, the mail may be read on a phone and the code typed on the computer that asked.

The procedure

On the sign-in screen click Forgot your password? and enter your address on the Forgotten password page.
A mail arrives, "Somebody asked to reset the password for … on Runjet", with the code. Type it beside the address on the Enter the code page.
On the Choose a new password page, choose one. Your password is set, and a link to sign in.

Three limits

Six digits is little entropy, so the security is carried by the limits around the code rather than by the code itself:

it lasts ten minutes,
it has five attempts; the fifth wrong one retires it and a new one has to be asked for. A correctly typed code costs no attempt, and a code of the wrong shape (letters, five digits) does not count at all,
an account takes ten wrong codes a day in total, across every code it was sent; past that, no code is accepted until the day has passed — not even the right one, so the limit cannot be felt out by guessing,
the code is bound to the address: without knowing whose it is, there is nothing to guess.

Beside those are two limits on sending, both silent: there is a delay between two requests for a code for the same address, and the number of codes per day is capped — 1,440 individually harmless mails a day is an inbox nobody can use.

Every address gets the same answer

After an address is submitted, the page says the same thing whether the address has an account, has none, or has an unaccepted invitation — otherwise it would be a way of finding out who has an account in Runjet. The same goes for the code page: a wrong code, an expired one, a retired one, none outstanding, no such account and an unaccepted invitation all end in one identical sentence. When a code "does not work" it is one of those six, and the only way on is to ask for a new one. A mail that does not arrive is usually an address Runjet does not know.

Every session ends

Setting a new password ends every session the account has, on every device — and starts no new one; you sign in again. That is the point rather than a precaution: somebody resetting a password because they think it was taken means that whoever took it may be holding a session right now. A new code also invalidates every previous one, unused ones included.

Your own password, the one you know, is changed without a code in your profile.

When an admin sends the code

An admin can send a code to anyone from an icon on their account, behind a confirmation: They choose the new password themselves, using a six-digit code that works once and expires in ten minutes. Their current password keeps working until they use it — and when they do, every session they have open ends. Any code already sent to them stops working now. It is the same mail a person could have asked for themselves; the admin never sees the password. The confirmation is there because it cannot be taken back, and the icon sits beside blocking and deleting.