ORIN runs one sign-in surface over two backends. Hosted gives verified email, real password reset, Google sign-in and cross-device sessions. Device-local keeps credentials on the device and therefore has no password reset — there is no channel over which a link could be sent.
Hosted mode
Email confirmation may complete signed-out: the account exists and is waiting on a clicked link, and the interface says so rather than dropping you onto an empty desk.
Google sign-in appears when the hosted backend exists. Its presence reports whether the backend is there, not whether the provider has been enabled server-side — a distinction that shows up as a provider error rather than a missing button.
Device-local mode
Credentials never leave the device. Passwords are hashed with a slow key-derivation function against local storage, with a minimum length enforced.
There is no second device and no Google. The reset control is hidden rather than shown and then failing — a control that opens a form and then does nothing is worse than its absence, because it costs the user the time to discover it.
The local recovery story
Export your data from Settings before clearing browser storage. That file is the entire backup, and this is stated as a design fact rather than as a warning tacked on.
A local-only account has no server that could recover it. Saying so plainly is the only responsible way to ship that mode.
Error honesty
Sign-in errors never confirm which email addresses have accounts. An error that distinguishes "wrong password" from "no such user" is an account-enumeration endpoint with a friendly face.
Frequently asked
- Why is there no forgot-password link on my install?
- You are on the device-local backend, where credentials never leave the device — so there is no channel to send a reset link over, and the control is hidden rather than faked. Export your data from Settings before clearing browser storage; that is the recovery story.
Updated Sep 1, 2026