Settings and Security
Monize provides comprehensive security features and configurable user preferences.
- User Settings
- Remember Me
- Two-Factor Authentication (2FA)
- Trusted Devices
- Password Management
- Account Lockout
- Single Sign-On (OIDC)
- Personal Access Tokens (PATs)
- Backend Connectivity
- Security Architecture
- Danger Zone
- Admin Features
Navigate to Settings (gear icon in the top-right corner) to configure your preferences.
| Setting | Description |
|---|---|
| Home Currency | Primary currency for reporting and dashboard totals |
| Preferred Exchanges | Up to 3 stock exchanges in priority order for security lookups (see below) |
| Date Format | How dates are displayed throughout the application |
| Number Format | Decimal and thousands separator preferences |
| Theme | Light or dark mode |
| Email Notifications | Toggle email notifications for bills and reminders |
When you look up a security by name or symbol, Yahoo Finance may return results from multiple exchanges around the world. The Preferred Exchanges setting lets you specify up to 3 exchanges in priority order so that results from your preferred exchanges are ranked first.
For example, if you primarily invest on the London Stock Exchange and the Toronto Stock Exchange, setting your preferred exchanges to LSE and TSX ensures that when you search for a security, matches from those exchanges appear before results from NYSE or other exchanges.
- Select up to 3 exchanges using the Priority 1, Priority 2, and Priority 3 dropdowns
- Priority 1 has the highest preference, followed by Priority 2 and Priority 3
- Results from preferred exchanges are boosted above all other results
- An exact symbol match on a preferred exchange always wins
- If no preferred exchanges are set, Monize uses its default exchange ranking (major US exchanges first)
Preferred exchanges are used whenever Monize looks up a security from Yahoo Finance:
- Securities page -- When adding or editing a security and using the Lookup button
- Import wizard -- When mapping securities during a QIF, OFX, or CSV import (both individual lookups and the "Lookup All" bulk operation)
- Security creation -- When creating a new security from the import mapping screen
Without preferred exchanges, searching for "Barclays" might return BCS (NYSE) as the top result. With LSE set as Priority 1, the search returns BARC.L (London Stock Exchange) instead.
The login page includes a "Remember Me" checkbox that extends your session duration from the default 1 day to a configurable period (default 30 days).
| Setting | Without Remember Me | With Remember Me |
|---|---|---|
| Access token | 15 minutes | 15 minutes |
| Refresh token | 1 day | 30 days (configurable) |
- When "Remember Me" is checked, the refresh token cookie is set with a longer expiry
- The access token still expires every 15 minutes and is silently refreshed using the refresh token
- Both tokens rotate on refresh (old tokens are revoked)
- Tokens are stored as httpOnly cookies and are never accessible to JavaScript
The duration can be configured via the REMEMBER_ME_DAYS environment variable:
REMEMBER_ME_DAYS=14 # 14-day sessions instead of the default 30If not set or set to an invalid value, the default is 30 days.
When two-factor authentication is enabled, the "Remember Me" preference is preserved through the 2FA verification step. After entering your TOTP code, the extended session duration is applied as expected.
Monize supports Time-based One-Time Password (TOTP) authentication for an additional layer of security.
- Navigate to Settings
- Click Enable Two-Factor Authentication
- Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)
- Enter the 6-digit verification code to confirm setup
- Save your backup codes in a secure location (see Backup Codes below)
After enabling 2FA:
- Enter your email and password as normal
- You will be prompted for a 6-digit TOTP code
- Enter the code from your authenticator app
- Optionally check "Trust this device" to skip 2FA on this device for future logins
When you enable 2FA, Monize generates 12 single-use backup codes. These are your fallback if you lose access to your authenticator app.
- Each code is an 8-character hexadecimal string (e.g.,
a1b2c3d4) - Codes are displayed only once at generation time -- save them in a secure location
- Each code can only be used once; after use, it is permanently removed
- During 2FA verification, you can enter a backup code instead of a TOTP code
- To regenerate backup codes, navigate to Settings and click Generate Backup Codes
Security Note: Backup codes are hashed with bcrypt before being stored in the database. The plain-text codes are never stored on the server.
- Navigate to Settings
- Click Disable Two-Factor Authentication
- Enter your current TOTP code to confirm
When logging in with 2FA, you can mark a device as "trusted" to skip the TOTP prompt on future logins from that device.
- Navigate to Settings
- Scroll to the Trusted Devices section
- View all currently trusted devices
- Click Remove to revoke trust for any device
Security Note: Trusted device tokens are stored as SHA-256 hashes in the database. The actual token is stored only in the browser cookie.
- Navigate to Settings or Change Password
- Enter your current password
- Enter and confirm your new password
- Click Save
Password changes immediately revoke all existing refresh tokens, logging you out of all other sessions.
Monize checks new passwords against the Have I Been Pwned database to prevent you from using passwords that have appeared in known data breaches.
- Checked during registration and password reset
- Uses the HIBP k-anonymity API -- only the first 5 characters of the password hash are sent, so your full password is never transmitted
- If the password has been found in a breach, you will see: "This password has been found in a data breach. Please choose a different password."
- If the HIBP service is unavailable, the password is allowed (availability over security)
- On the login page, click Forgot Password
- Enter your email address
- Check your email for a reset link
- Click the link and set a new password
Security Note: Password reset tokens are hashed with SHA-256 before being stored in the database. The token expires after a set time period.
Monize protects against brute-force login attacks with automatic account lockout.
| Setting | Value |
|---|---|
| Max failed attempts | 5 consecutive failures |
| Base lockout duration | 30 minutes |
| Escalation | Exponential backoff (30 min, 60 min, 120 min, etc.) |
- After 5 consecutive failed login attempts, the account is locked
- The lockout duration doubles with each subsequent lockout cycle:
- 1st lockout (5 failures): 30 minutes
- 2nd lockout (10 failures): 60 minutes
- 3rd lockout (15 failures): 120 minutes
- If email is configured, a lockout notification is sent to the account owner
- A successful login resets the failure counter and clears any lockout
Note: Login attempts for non-existent accounts return a generic "Invalid credentials" message and do not reveal whether the account exists.
Monize supports OpenID Connect (OIDC) for single sign-on integration with identity providers.
- Authentik
- Authelia
- Pocket-ID
- Any OpenID Connect-compatible provider
OIDC is configured via environment variables:
OIDC_ISSUER=https://your-identity-provider.com
OIDC_CLIENT_ID=monize
OIDC_CLIENT_SECRET=your-client-secret
OIDC_REDIRECT_URI=http://localhost:3001/auth/callbackWhen OIDC is configured, a "Sign in with SSO" button appears on the login page.
Personal Access Tokens provide API access for external integrations such as MCP clients. Tokens are managed in Settings > AI under the MCP / Personal Access Tokens section.
Each token is created with one or more scopes that control what operations it can perform:
| Scope | Description |
|---|---|
| read | Read access to accounts, transactions, categories, payees, and other resources |
| write | Create, update, and delete resources |
| reports | Access to report generation endpoints |
Scopes are enforced server-side via a scope guard. Endpoints decorated with required scopes will reject tokens that lack the necessary permissions.
- Tokens are prefixed with
pat_for easy identification - The full token is displayed only once at creation time
- Tokens are stored as SHA-256 hashes in the database
- Tokens can have an optional expiration date
- Revoke a token at any time from the settings page
- Tokens are rejected if the owning user account is locked or disabled
For MCP integration details, see AI > MCP Server.
If the Monize backend becomes unavailable (e.g., during a server restart or network issue), the frontend automatically detects the outage and displays a notification banner.
- When any API call receives a 502 status or no response (network error), the frontend enters "backend down" mode
- A red banner appears at the top of the page: "Connection Lost -- Unable to reach the server. Retrying automatically..."
- The frontend polls the backend health endpoint (
/health/live) every 5 seconds - When the backend responds successfully, the page reloads automatically to restore normal operation
This prevents false logouts during temporary backend outages -- instead of being redirected to the login page, you see a clear status message and automatic recovery.
Monize implements comprehensive security measures:
| Feature | Implementation |
|---|---|
| Password Hashing | bcrypt with salt rounds |
| Password Breach Check | HaveIBeenPwned k-anonymity API on registration and password reset |
| Account Lockout | 5 failed attempts triggers lockout with exponential backoff |
| Access Tokens | JWT with 15-minute expiry |
| Refresh Tokens | 7-day rotating tokens with family-based replay detection |
| TOTP Encryption | Per-user unique salt (not shared secret) |
| 2FA Backup Codes | 12 single-use codes, bcrypt-hashed, generated on 2FA setup |
| Personal Access Tokens | Scoped (read/write/reports), SHA-256 hashed, revocable |
| Rate Limiting | 100 req/min global, 3-5 per 15 min on auth endpoints |
| Feature | Implementation |
|---|---|
| User Isolation | All database queries filter by userId |
| Input Validation | DTO validation with whitelist mode (rejects unknown fields) |
| SQL Injection | Parameterized queries via TypeORM |
| XSS Protection | No dangerouslySetInnerHTML, HTML escaping in emails |
| CSRF | Token validation with httpOnly cookies |
| Header | Value |
|---|---|
| Content-Security-Policy | Restrictive CSP with style-src and script-src whitelist |
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | DENY |
| Referrer-Policy | strict-origin-when-cross-origin |
| Cross-Origin-Opener-Policy | same-origin |
| Cross-Origin-Resource-Policy | same-origin |
| Permissions-Policy | Restrictive policy |
If you are running Monize over plain HTTP without a reverse proxy such as Traefik, set the DISABLE_HTTPS_HEADERS environment variable to true:
DISABLE_HTTPS_HEADERS=trueThis disables two headers that require HTTPS to function correctly:
- Strict-Transport-Security (HSTS) -- Forces browsers to use HTTPS; invalid over HTTP
- Cross-Origin-Opener-Policy (COOP) -- Can cause issues with HTTP-only deployments
It also disables the Secure flag on authentication cookies so they work over plain HTTP.
Do not use in production with HTTPS. Only set this when HTTPS is not available at the application level.
The Danger Zone section at the bottom of Settings provides options to delete your financial data or your entire user account. These actions are irreversible.
Delete Data removes your financial data while keeping your user account intact. This is particularly useful when migrating from Quicken or Microsoft Money -- if an import did not go as expected, you can wipe the data and start over without recreating your user account or reconfiguring your settings.
Navigate to Settings, scroll to Danger Zone, and click "Delete Data...".
The following data is always removed when you delete data:
- All transactions and transaction splits
- All scheduled/recurring transactions
- All securities, security prices, holdings, and investment transactions
- All budgets, budget periods, budget categories, and budget alerts
- Monthly account balance summaries (net worth snapshots)
- Custom reports
- Tags
- Import column mapping presets
- AI insights and usage logs
You can optionally choose to also delete:
| Option | What It Does |
|---|---|
| Accounts | Deletes all financial accounts. If unchecked, accounts are kept but their balances are reset to the opening balance. |
| Categories | Deletes all categories. References to categories on payees and accounts are cleared first. |
| Payees | Deletes all payees and payee aliases. |
| Currency preferences | Deletes saved exchange rate preferences. |
Migration Tip: If you are re-doing an import from Quicken or Microsoft Money, check all four optional boxes to get a completely clean slate. If you only want to re-import transactions but keep your account structure, leave "Accounts" unchecked -- account balances will be reset to their opening balance automatically.
- Password users: You must enter your password to confirm the deletion
- SSO (OIDC) users: You must re-authenticate with your identity provider
The operation runs inside a database transaction -- if an error occurs, no data is deleted.
Delete Account permanently deletes your entire user account and all associated data. After deletion, you are logged out and redirected to the login page.
Navigate to Settings, scroll to Danger Zone, and click "Delete Account".
To confirm:
- Type DELETE in the confirmation field
- Enter your password (or re-authenticate via SSO)
- Click "Confirm Delete"
Note: You cannot delete your account if you are the last admin user. Assign the admin role to another user first.
Users with the admin role have access to additional features.
Navigate to Admin > User Management to manage application users.
Admin capabilities:
- View all registered users
- Change user roles (user/admin)
- Disable or enable user accounts
- Reset user passwords
Note: The admin section only appears in the navigation if your user account has the admin role.