Lockout after failed password attempts: how it works

What the lockout after failed password attempts is

The lockout after failed password attempts is an automatic brake on the two qmen.us screens that ask for a short password: each waiter's link and each kitchen's display. We count the mistakes within a five-minute window and shut the door in two ways. Ten mistakes from the same connection on the same account, and that connection stops being accepted there. Across all connections combined, thirty mistakes on the same account and the whole link is locked until the window resets.

There's nothing to turn on or adjust: every restaurant comes with it. While the door is shut, the screen answers Too many attempts. Wait a few minutes and try again. instead of the usual Wrong password. — and doesn't even look at what was typed. Anyone already inside keeps working normally: the lock only catches whoever is trying to get in at that moment.

Why qmen.us has this brake

• A short staff password needs a safety net. The Restaurant password and the Display password are meant to be typed quickly, sometimes on the on-screen keyboard of a kitchen tablet. Passwords that short, with no cap on attempts, would be easy to guess for anyone who found the address.
• One locked-out waiter doesn't bring down the whole restaurant. The count is separate per link: if one waiter gets it wrong ten times, the kitchen and the other waiters keep signing in as if nothing happened. Each kitchen also has its own count.
• Switching networks doesn't restart the game. Besides the per-connection limit, there's a per-account cap that adds everything up. Anyone hopping between internet connections to reset the count runs into the account's thirty mistakes and gets locked out just the same.
• You can't pretend the attempt came from somewhere else. The origin is read from a header that only our own edge writes. Whatever the browser sends on its own saying where it came from is ignored, precisely because it's easy to fake.
• The owner's sign-in doesn't even have a password to get wrong. The main qmen.us sign-in is Google only: there's no password field there. The short password is limited to what needs it — the waiter's phone and the kitchen screen.

What to do when access locks, in 6 steps

Six steps, from the notice on screen to access working again — and what to do when the attempts didn't come from your team.

1. See which of the two notices appeared

   The password screen has two different messages, and they don't mean the same thing. Wrong password. is a simple mistake: the password typed doesn't match, and you can try again right away. Too many attempts. Wait a few minutes and try again., on the other hand, is the lockout: in that state we don't even check the password, so insisting gets you nowhere — you just wait out the clock.

2. Wait for the five-minute window to pass

   The mistake count lasts five minutes, counted from the first mistake, and clears itself at the end. There's no unlock button on the Dashboard, and the qmen.us team doesn't unlock it by hand either. Once the minutes are up, the password screen works as before, without you doing anything.

3. Check the right password on the Dashboard

   While the clock runs, use the time to find the right password. On the Dashboard, Waiters shows the Password set block on each card, and Kitchens shows Display password. Tap the eye icon next to the dots to reveal it. If instead of the password you see reset it under “Change” to see it, that password is old and can't be shown anymore — the way forward is the next step.

4. Reset the password if nobody remembers it

   On the same card, the Set button (or Change, when one already exists) changes the password right away. It needs at least 4 characters — anything shorter comes back with The password needs at least 4 characters. Pick something short your team can type right the first time, because every rushed mistake counts toward the lockout.

   Tip: Changing the password doesn't sign out anyone already signed in, and it doesn't clear a lockout in progress either: whoever got locked out keeps waiting out the minutes, even with the new password in hand.

5. Sign in again and the count resets

   With the right password, tap Sign in. Getting it right clears both counts at once — the connection's and the account's — so the next mistake starts from zero. If the waiter has an email on file, their screen also offers Sign in with Google, which is another way in and doesn't depend on any password.

6. If the attempts didn't come from your team, revoke access

   Repeated lockouts on a link nobody at the restaurant was using are a sign the address leaked. Reset that waiter's or that kitchen's password and, if the person no longer works for you, use Remove on the card: access drops instantly, even on a device that was already signed in. In the Waiter app you can also end the phone's session with sign out, at the top.

Frequently asked questions

Glossary

Restaurant password

A short password the owner sets so a waiter can sign in to the app without a Google account.

Display password

A short password, at least 4 characters, that unlocks a kitchen's screen on that device. Each kitchen has its own.

Waiter app

The ordering page each waiter opens through the restaurant's own link, right in the phone's browser.

Kitchen display

The wall screen that shows that prep station's queue live, protected by a password.

Dashboard

The owner's screen, at qmen.us/restaurante/painel/, with active orders, occupied tables, today's revenue and a shortcut to Settings.

Related resources