Brute-Force Lockout and PIN Recovery

To protect the vault from PIN-guessing attacks, Loyva locks the vault after repeated failed attempts. The lockout is per user, not per organization.

How the lockout works

  • 5 failed PIN attempts in a row triggers a lockout.

  • The vault is locked for 15 minutes from the last failed attempt.

  • During the lockout, the PIN entry dialog refuses input even if you remember the correct PIN.

  • A successful PIN entry resets the counter to zero.

Recovering a forgotten PIN

  1. Wait out the lockout if you're currently locked (or use the reset flow below to clear it).

  2. Open Settings → Vault PIN and choose Reset PIN.

  3. Re-authenticate (Loyva re-verifies your account password or current session).

  4. Set a new PIN. The lockout counter is cleared at the same time.

Admin help

Org admins cannot read or set a user's PIN. That's by design, since the PIN is the second factor for vault access. If a user is stuck, they reset it themselves from Settings.

Note: All failed attempts and lockouts are written to the audit log so security review is possible after the fact.