Account security

01How we protect you

• Passwords are hashed one-way with a dedicated algorithm; nobody — not even administrators — can see the original.
• Every connection uses HTTPS. Your browser only talks to the site’s own server, never directly to the systems behind it.
• Sign-in attempt limits and a captcha at sign-up block automated password guessing.
• Live rooms use random room codes; control of a room is tied to the host’s private host code.
• Public question sets are reviewed before strangers can see them.

02What you should do

• Use a long password that you do not reuse on other sites.
• Turn on two-factor authentication (2FA) on the Account page and keep your recovery codes safe.
• Sign out on shared computers; use "Sign out everywhere" if you think your account was exposed.
• Never share the host code with players — share only the join code.

03Two-factor authentication (2FA)

Once enabled, each sign-in also asks for a 6-digit code from an authenticator app (Google Authenticator, Microsoft Authenticator…). If you lose your phone, use a recovery code — each one works only once.

04Reporting a vulnerability

If you find a security issue, please report it privately through the Contact page (topic "Report a problem") with steps to reproduce it. Please do not publish it before we can fix it. Thank you for helping keep the site safe.