Account security

This page is about your Thrall account. For your game logins, see The vault.

Your password

• At least 10 characters. Length matters more than symbols.
• Stored only as an scrypt hash. Nobody at Thrall can read it.
• Change it in Panel, Security. Changing it signs out every other device.

Forgot it

On the sign-in page choose Forgot? and enter your address. If it has an account, a link arrives by mail. The link works once and for one hour. Resetting signs out every device.

Two-factor sign-in

With two-factor on, signing in needs your password and a six-digit code from an authenticator app.

Turn it on

1. Open Panel, Security and choose Turn on.
2. Scan the QR code with an authenticator app such as 1Password, Authy or Google Authenticator.
3. Enter the six digits the app shows.
4. Save the ten recovery codes. They are shown once.

Turning it on signs out your other devices.

Recovery codes

Each recovery code signs you in once, in place of the six digits, if you lose your authenticator. Keep them somewhere other than the phone the authenticator is on.

Make a new set at any time from the Security page. The old set stops working.

Lost both

If you have neither the authenticator nor a recovery code, write to help@thrall.dev from the address on the account. Expect to be asked to prove the account is yours, and expect it to take a few days. That delay is deliberate.

Devices

The Security page lists every browser signed in to your account, with its address, country and when it was last active.

• Sign out ends one.
• Sign out the others ends all but the one you are using.

A session lasts 30 days from its last use.

Recent activity

The same page lists sign-ins, wrong passwords and security changes, with where they came from.

Protections that are always on

• After three wrong passwords for an address, sign-in asks for a human check.
• After ten in 15 minutes, sign-in for that address pauses for 15 minutes.
• Five wrong two-factor codes end the session.
• Mail is sent when your password changes or two-factor is turned on or off.

If something looks wrong

1. Change your password. That signs out everyone else.
2. Turn on two-factor sign-in if it is off.
3. Check Recent activity for sign-ins you do not recognise.
4. Write to help@thrall.dev.

Your vault is not affected by someone signing in to your Thrall account from another browser: it is stored on your device and locked with a different passphrase.