How we protect your account
We will never ask for your password, a verification code or a Discord token: not in Discord, not by email and not through a bot.
Passwords and links#
- Your password is never stored in readable form. We store only a slow, salted hash that also depends on a secret kept outside the database.
- Verification and password-reset links work once and expire quickly.
- Changing your password signs out every other session and sends you an email.
Two-factor authentication#
Two-factor authentication with an authenticator app is available for every account and required for staff.
Sessions#
You can see and end your active sessions. Signing out everywhere also disconnects the Discord authorization.
Bot tokens#
Bot tokens are never shown on the website and never needed from you. You add the bots with Discord's own invite page.