Account Security: 2FA, Passkeys, and Browser Sessions

Your account holds your VC balance and access to all your characters. This guide explains how to protect it.

Important: 2FA and passkeys only protect the website. The game login still uses your username and password, so a leaked password is dangerous even with 2FA turned on.

---

1. Password

• Use 12 random characters, mixing lowercase letters and numbers.
• Do not reuse a password from another account, especially your email.
• Never give your password to anyone, including people who claim to be a GM.
• Keep your account email active, and make sure only you can open it.

---

2. Two-Factor Authentication (2FA)

With 2FA, signing in to the website needs your password and a 6-digit code from an authenticator app, such as Google Authenticator, Authy, or 1Password.

How to turn it on

1. Open your Profile page, Two-Factor Authentication section.
2. Click Enable, then confirm your password if asked.
3. Scan the QR code with your authenticator app, or enter the Setup Key manually.
4. Enter the 6-digit Verification Code from the app.
5. Store your 8 recovery codes somewhere safe, away from your phone.

If you lose your phone

• On the sign-in page, enter one of your recovery codes in the code field. Each code works once.
• After signing in, use Regenerate Codes to create new codes. The old codes stop working.
• If you lost your recovery codes too, use Forgot Password. A reset by email turns off 2FA, and you can then turn it on again.

---

3. Passkeys

A passkey lets you sign in to the website with your fingerprint, face, or device PIN instead of typing your password. Passkeys stay on your device or password manager and cannot be stolen by a fake site.

How to add one

1. Open your Profile page, Passkeys section.
2. Enter a passkey name, for example "My phone".
3. Click Add passkey, then confirm your password if asked.
4. If 2FA is on, enter a 2FA code or a recovery code.
5. Follow the prompt from your browser or device.

Each account can have up to 10 passkeys. Supported browsers are the latest versions of Chrome, Edge, Safari, and Firefox.

How to use it

On the Sign In page, click Sign in with a passkey. You are not asked for your username, password, captcha, or 2FA code, so always keep your device locked.

If you lose a device, sign in from another device and remove that passkey on your Profile page. Your password keeps working.

---

4. Browser Sessions

The Browser Sessions section on your Profile page shows every browser and device signed in to your account.

• Log out this session signs out one device.
• Log Out Other Browser Sessions signs out every device except the one you are using.

If you do not recognize a session, log it out and change your password.

---

5. Email Notices

We send an email when something important changes:

• Your password is changed or reset.
• 2FA is turned off.
• A passkey is added or removed.
• An email change is requested.

If you did not make that change, follow the steps in section 6.

---

6. If Your Account Is Hijacked

1. Change your password right away. If you cannot sign in, use Forgot Password.
2. In Browser Sessions, click Log Out Other Browser Sessions.
3. Check the account email on your Profile page, then remove any passkey you do not recognize.
4. Turn 2FA back on if it was turned off.
5. Change your email password.
6. Open a support ticket with your character name, the time it happened, and what changed. If you cannot sign in, use the Contact Us page.

---

FAQ

Why am I asked for my password again when I am already signed in?

Sensitive actions such as changing 2FA, logging out sessions, or changing your email need a recent confirmation. A confirmation lasts 15 minutes.

Do I need 2FA if I already use a passkey?

You can use both. A passkey skips the 2FA code at sign-in, but 2FA still protects you when someone signs in with your password.

Can I use a passkey to log in to the game?

No. The game login always uses your username and password.