Your account

Registering

1. Open the site and click Sign up (Załóż konto) in the header, or go to /register.
2. Enter your name, email address and a password of at least ten characters, then repeat the password.
3. Submit. You are signed in immediately and a verification email is sent to you.

New accounts are students. If the sign-up links are missing, this installation has closed self-registration: an administrator creates accounts instead, and you receive an email with a link to set your password.

Parts of the site — your account page, your courses — need a verified email; until you verify, they send you to the verification notice, where you can ask for the link again.

Verifying your email

Open the message “Zweryfikuj swój adres e-mail” and click the button. The link is valid for a limited time; if it expired, sign in and request a new one from the notice page.

Setting a password from a link

If somebody created your account for you — an administrator, or the shop you bought a course from — you receive a message saying your account is ready (“Twoje konto w … jest gotowe”). Click Set the password (Ustaw hasło), choose one, and you are signed in.

The link works for seven days, and it stops working the moment the password changes. If it has expired, use Forgot your password? on the login page instead.

Signing in

/login offers as many ways in as this installation has configured:

• Password: email and password. Tick Remember me (Zapamiętaj mnie) to stay signed in. After five failed attempts in a minute you have to wait. A wrong address and a wrong password are answered with the same sentence, so the form never tells anybody whether an address has an account here.
• A passkey: the button Sign in with a passkey (Zaloguj się kluczem dostępu) appears only in a browser that supports them, and only works once you have added one from your account page. Your device asks for your fingerprint, your face or its PIN.
• Google or Facebook: the buttons appear under the login and registration forms when the site has the provider configured.

Signing in with a provider creates a verified student account if the address is new — but only when the provider confirms the address is yours. Google does not confirm every address it holds; when it does not, no account is opened and you are asked to register with your email address instead. If an account with that address already exists, the provider must confirm the address is yours before the two are joined; when it does not, you are asked to sign in with your password and connect the account from My account instead. The provider must also share your email address, or you are sent back with an explanation.

Where you land depends on your role: editors, instructors and administrators go to the panel, everyone else to the page this site sets aside for its students — on a new installation, Moje kursy — or to the front page when it has set none aside.

Two-factor authentication

If you have turned it on, signing in with a password stops at a second step: the six-digit code from your authenticator app, or one of your recovery codes. Each recovery code works once.

A passkey login skips this step. That is deliberate: a passkey already proves both that you hold the device and that you unlocked it.

Forgotten password

1. On the login page click Forgot your password? (Nie pamiętasz hasła?).
2. Enter your email and press Send reset link (Wyślij link).
3. A page titled Check your email (Sprawdź pocztę) says the link is on its way if an account exists for the address you typed. It says the same whether one does or not, so nobody can use the form to find out who has an account here; the address is shown back so you can spot a typo, and Send another link (Wyślij kolejny link) takes you back to the form.
4. Open the email, choose a new password (at least ten characters) and repeat it.
5. Sign in with the new password.

Nothing arrived? Look in your spam folder, or ask again after a minute — a second request within the minute sends nothing new. Changing your password ends every other session you had open.

When a form says to wait

Every form that checks a password, a code or a link counts the attempts: five a minute for the password confirmations, three a minute for reset links, ten an hour for new accounts. When the count is used up you see Too many attempts (Zbyt wiele prób) and how long to wait — “Spróbuj ponownie za 42 sekundy” — then the form works again. Nothing is locked for good.

Your account page

/account (Moje konto) is where you manage everything about yourself, as a page of cards. The panel’s user menu links here too: HiLMS has one account page, not two.

Profile (Profil)

Your photo, your name, your email address, the language you read in, the clock your dates are shown on, and any extra fields this installation asks of your role — an instructor is usually asked for a job title, a short biography and links.

• Photo (Zdjęcie): JPEG, PNG or WebP, cropped to a square. Tick Remove the photo I have now (Usuń dotychczasowe zdjęcie) to go back to your initials, which the site draws for you.
• Language (Język) appears where the site speaks more than one. It is the language of the site and of the mail HiLMS sends you, and it follows you onto another computer. The switch in the header changes it too, without asking anything (see Languages).
• Time zone (Strefa czasowa) is the clock every date and time on the site is written on — when your access to a course ends, when you finished one, when a passkey was added. Leave it on Taka jak na stronie (the same as the site) and you get the site’s own clock, which is what everybody who has not chosen gets. Pick a zone and every date follows you, in the panel as well if you work there. Nothing about what is stored changes: only which hour it is written as.
• Saving this card asks for your password first, because it also holds your email address. Changing that address un-verifies the account and sends a new verification link.

Your photo and your profile fields are what other people see: an instructor’s card on a course page is built from them.

Password (Hasło)

Your current password, the new one and its repetition. An account that only ever signed in with Google or Facebook sees Set a password (Ustaw hasło) instead, with no current password to give. Five wrong current passwords in a minute make the form wait — the same five as confirming your password and deleting the account, all together — so somebody who found your computer signed in cannot guess their way to your password.

Two-factor authentication (Uwierzytelnianie dwuskładnikowe)

A code from your phone as well as your password.

1. Click Enable (Włącz) and confirm your password.
2. Scan the QR code with an authenticator app, or type the key it shows by hand.
3. Enter the code the app displays and click Confirm (Potwierdź).
4. Save the recovery codes (Kody zapasowe) somewhere safe. They are shown once, and each one signs you in once if you lose the phone.

New recovery codes (Nowe kody zapasowe) replaces the set; Disable (Wyłącz) turns the second factor off.

Passkeys (Klucze dostępu)

A passkey lets you sign in with your fingerprint, your face or your device’s PIN instead of a password. The key is created on the device you are using and stays there or in your password manager, so add one per device you want to sign in from.

Adding or removing a key asks you to confirm your password first; after confirming you come straight back to this page. Give the key a name, click Add a passkey (Dodaj klucz), and follow your browser’s prompt.

Connected accounts (Połączone konta)

Every provider this installation supports, with a Connect (Połącz) link, or the date it was connected and a Disconnect (Odłącz) button.

Disconnecting is refused when it is your only way in — no password chosen, no other provider, no passkey. Set a password first.

Your data (Twoje dane)

Download my data (Pobierz moje dane) prepares an archive of everything this installation stores about you and emails you a link. It holds one file per kind of data: your profile, your connected accounts, your passkeys, the courses you were granted, your progress, your quiz attempts and the trail of what you did.

You can ask once an hour, the link works only while you are signed in, and the archive is deleted after a few days.

Delete my account (Usuń moje konto)

Deletion is immediate and cannot be undone. Your name, email address, photo, passkeys and connected accounts go, and you can never sign in again.

What stays is a record with no personal data in it: which courses the account was granted and when, so a purchase history survives. Confirm with your password, or — if you only ever signed in with a provider — by typing your email address. Wrong passwords count towards the same five-a-minute limit as the password form.

The last administrator account cannot be deleted. Give somebody else the administrator role first.

Light and dark

Until you choose, the site follows whatever your system asks for. The switch in the header cycles through three states — light, dark, and back to following the system — drawing a sun, a moon or a monitor and naming the one it is in (Motyw kolorów: jasny, … ciemny, … systemowy). Your choice is remembered in that browser for a year.

Finding your way with a keyboard

• The first thing the Tab key reaches on every page is Przejdź do treści, which jumps past the header straight to the page itself.
• Whatever has the keyboard’s attention is outlined, always.
• On a phone the header holds a menu button; it opens the navigation, the language links and your account links as a panel, closes with Escape, and keeps the keyboard inside it while it is open.
• A course page and a lesson have a side panel of their own, opened by a button at the top left. Closed, it is out of the way of the keyboard entirely; on a narrow screen it opens over the page and Escape closes it (see Browsing and learning).

Signing out

Click Log out (Wyloguj się) in the header, or use the user menu in the panel.