Security

Two-factor authentication

You can turn on 2FA (an authenticator app, with backup codes) in Settings. Once it's on, it's required on every sign-in, whether you sign in with a password or with Google.

Password breach checking

New passwords are checked against a public database of known-breached passwords before they're accepted, so a password already exposed elsewhere can't be reused on Bagged.

Encrypted payment details

Payment method details you add are encrypted at rest (AES-256-GCM) before they're stored, not saved as plain text.

Encrypted OAuth tokens

Tokens from signing in with Google are encrypted at rest, not stored as plain text.

Rate limiting and lockout

Sign-in, password-reset, and two-factor verification attempts are rate-limited, and an account temporarily locks after repeated failed two-factor attempts.

HTTPS everywhere

Bagged is served over HTTPS only, with HSTS enabled so a browser won't fall back to an unencrypted connection.