When you add an access code in SignClearly, the form tells you to share it by phone or chat, not by email. This post explains why, and what the code can and cannot do.
Why the code must take another route
The signing link in the email is one factor. Whoever can read that email can open the document. An access code adds a second factor only if it reaches the signer by a route the email does not share.
An email can reach the wrong reader in ordinary ways:
- a typo in the address;
- an automatic forwarding rule;
- a shared inbox, such as an office address several people read;
- an assistant who handles the recipient's mail;
- a mailbox someone else has broken into.
In each case the reader gets everything inside the email. If the code is in it, or in a second email to the same address, they have the code too. A call or a text to a number you already have for the person does not depend on their mailbox, and a messenger works the same way. A call also lets you hear who answers.
Keep the code out of the message field as well. The message you write appears in the invitation email and on the signing page.
What the code protects against
- A link that reached the wrong person. Without the code, the signing page shows only the document name, the sender and when the link expires. The server does not send the PDF or its fields, and no “opened” event is recorded.
- Guessing. After 5 wrong attempts in a row the code locks, and even the right code is refused until you send the invitation again. The server also limits how many codes one link can try in a short time.
- A copy of SignClearly's database. The code is stored only as a salted scrypt hash, a format built to make each guess slow. SignClearly cannot read the code back, so it cannot put it in an email or show it to you later.
What it does not protect against
- A signer who passes the code on. The code shows that whoever signed had both the email and the code. It does not show who that person was.
- A second channel in the same wrong hands. If someone controls the recipient's email and their phone or messenger account too, the code adds nothing.
- A code that is easy to guess. Five attempts are enough to try a birthday, a company name or 123456. Pick a random code.
- Later copies of the signed PDF. The code guards the signing page. The signed PDF has no password, so anyone who later receives the file can open it.
If you need to know who signs, require an ID check as well. The recipient then shows an ID document and takes a selfie with a third-party identity service, and the name on the ID must match the name you entered.
How access codes work in SignClearly
For the sender
You set the code on the “Who should sign?” step, before you send. It is optional and 6 to 32 characters long. Spaces at the start and end are dropped, line breaks are not allowed, and capital letters count. SignClearly keeps only the hash, so write the code down before you save. You can change or remove it while the document is a draft. Once it is sent, the code stays as it is.
The invitation email tells the recipient that the document is protected and that you will share the code separately. The code itself is never in the email.
For the signer
- Opens the link from the email. The page asks for the access code before the document opens.
- Enters the code. After a wrong code, the page shows how many attempts are left.
- Signs. The right code opens a signing session of 2 hours. If the session ends or the page is closed, the code is needed again.
After 5 wrong attempts in a row, the page says the code is locked and asks the signer to contact you. Resend the invitation: the recipient gets a new link, the old one stops working, and the count of wrong attempts goes back to zero. The code stays the same, and resending is free.
In the record
The event log records each wrong attempt with its number and whether it locked the code, and the moment the right code was entered. The code itself never appears in the log. The certificate page of the signed PDF shows “Second factor: Access code shared by the sender outside email”, or “None” when there was no code.
The certificate for the signer's browser key also notes that an access code was entered.
When you sign your own document, there is no access code: your sign-in to the account confirms you. See how to sign your own PDF.
How to share the code
- Use a phone number or messenger account you already had for the person, not one taken from the email thread.
- Make the code random and longer than the minimum.
- If you read it aloud, avoid characters that sound or look alike, such as 0 and O or 1 and l, and say which letters are capitals.