Demo login is pre-filled. Passwords are bcrypt-hashed; accounts lock after 5 failed attempts.