Security and passkeys

Signing in

Three ways, and you can use more than one.

Password. At least twelve characters. WinchWorks rejects common passwords and anything containing your email address.

Passkey. Sign in with your face, fingerprint or device PIN instead of typing anything. Set one up from your account menu.

Two-factor codes. A six-digit code from an authenticator app, on top of your password.

Why passkeys are worth ten minutes

A passkey is tied to your device and to app.winch.works. There is nothing to type, so there is nothing to guess, reuse, or hand over to a convincing fake sign-in page. It is the single biggest improvement you can make to your account, and it makes signing in on a phone in the yard faster than a password.

Set one up on each device you use. Keep your password as a backup for a device that has no passkey.

Passkey sign-in also skips the anti-bot check on the sign-in page, so if that check ever misbehaves, a passkey gets you in.

Two-factor codes

If you would rather not use passkeys, turn on two-factor from your account menu. You scan a code with an authenticator app, and it asks for a six-digit code each time you sign in.

What we do at our end

Your data is yours alone. Every account's data is separated, and every request is checked against the account you signed in with. No shop can see another shop's records.

Passwords are never stored. Only a value that cannot be turned back into your password.

Repeated failed sign-ins are locked out for a while, so nobody can sit there guessing.

Changing your password signs out every other session on that account. If you think someone else has been in, change it — that ends their access everywhere.

Everything that touches money is logged — who, when, what it was before and after. Owners can read and search that log in Settings.

Your data stays exportable. Owners can download the whole account at any time.

Losing access

Forgot your password — use the link on the sign-in page.

Lost the device with your passkey — sign in with your password and remove the old passkey from your account menu, then add one on the new device.

Lost your authenticator — an owner in your shop can reset your account. If you are the owner and locked out, email hello@winch.works.

Staff who leave

Disable the account rather than sharing a password around. See Users and roles.

Disabling ends access immediately and keeps their name on the work they did.

Reporting a problem

Security issues go to security@winch.works. Everything else goes to hello@winch.works.

What the assistant will not discuss

The in-app assistant answers questions about how WinchWorks works. It will not discuss how the system is built, and it has no access to any account's data — including yours. Ask it how passkeys work and it will tell you. Ask it anything about your own records and it will pass you to a person.