Security & Session Management
Your account security is our top priority. We use bcrypt hashing, JSON Web Tokens (JWT), and server-side blacklisting to block unauthorized access.
This module covers account security rather than email authentication - the two get confused constantly. SPF, DKIM and DMARC prove your messages are genuinely yours, and they live in the Credentials Vault module. What follows here is about protecting access to the platform itself, and to the sending credentials it holds on your behalf.
Why session revocation matters more than password strength
Most accounts are not lost to guessed passwords. They are lost to a session token that outlived the reason it was issued - a laptop left at a former employer, a browser on a shared machine, a token captured months ago and still valid because nothing invalidated it. Changing a password on many systems does nothing to existing sessions, which continue working until they expire naturally. Here, a password change or sign-out adds the affected tokens to a blacklist checked on every request, so revocation is immediate rather than eventual.
Password resets that cannot be replayed
A reset flow is a deliberate account-takeover mechanism that you have chosen to expose, so its constraints matter. Reset tokens here are cryptographically generated, single-use, and time-limited. Single-use is the property people overlook: without it, an old reset email sitting in a compromised inbox remains a working key to the account indefinitely. Passwords themselves are stored hashed and are never recoverable, which is why a reset issues a new token rather than mailing you the existing password.
Why this module protects more than your data
An email platform account is a higher-value target than most, because it holds working SMTP credentials for real mailboxes. Someone reaching your account does not merely read your campaign history - they gain the ability to send as your domain, which is worth considerably more to an attacker than the contact list itself. That is the reasoning behind treating session handling and credential storage as security-critical rather than as convenience features.
Practical guidance for protecting the account
Two habits matter more than the rest. Use a dedicated sending mailbox rather than a personal one when connecting accounts, so that revoking platform access never means changing credentials someone uses daily. And sign out explicitly on shared or temporary machines rather than closing the tab, because session revocation is what actually invalidates the token - closing a browser does not. If you suspect an account has been reached, changing the password immediately terminates every other active session through the blacklist, which is the fastest containment available to you.
Why account security is a deliverability concern
Compromised sending accounts are not typically used to read your data. They are used to send, because a mailbox with an established reputation on an authenticated domain is exactly what someone distributing phishing or spam wants. The consequence lands on you: the volume leaves under your domain, the complaints attach to your reputation, and the recovery is measured in weeks. Treating platform access as security-critical protects the sending asset you have spent months building.
Feature Breakdown
User Registration & Secure Login
Secure email registration and login architecture, protected by strict password policies and automated account lockouts.
Technical Capabilities:
Transactional Password Reset Flow
Allows users to recover access securely through time-restricted tokens sent via premium transactional delivery partners.
Technical Capabilities:
Session Management & JWT Blacklisting
Validates all API queries via secure JSON Web Tokens and supports server-side session termination on logout.
Technical Capabilities:
Spec Sheet
Need a Deep Dive?
See exactly how this module manages background queues, encryption, and delivery logic in our sequence flowchart.
View technical guideReady to Connect Your Nodes?
Scale your deliverability with our intelligent sharding relay. Add your domains and start landing in the inbox.
Security & Session Management questions.
The specifics people ask about before relying on this part of the platform.
How are account passwords stored?
Passwords are hashed, never stored in a form that can be reversed. Nobody at Email.biz.pk can read your password, and a password reset issues a fresh cryptographic token rather than mailing you the existing one.
What happens to my active sessions when I change my password?
Existing session tokens are added to a blacklist and rejected immediately, so a password change or a sign-out genuinely ends every other session rather than leaving old tokens valid until they expire.
Do password reset links expire?
Yes. Reset tokens are single-use and time-limited, so an old reset email cannot be used to take over an account later.