Account Security Features

Security Overview

The Security section gives you a central dashboard to manage all the ways your L2 Draco account is protected. Four summary cards show your current status at a glance:

• Two-Factor Authentication — Whether 2FA is enabled and which methods are active.
• Devices — How many devices are approved to connect to the game with your accounts.
• Credentials — Your email address and password settings.
• Linked Accounts — External accounts connected to your profile, such as Discord.

Each card includes a link to its dedicated management page. The sections below explain every feature in detail.

Two-Factor Authentication (2FA)

Two-factor authentication adds a second verification step when you log in. Even if someone discovers your password, they cannot access your account without also having the second factor.

Manage your 2FA settings at /account/security/two-factor.

Authenticator App (TOTP)

The most secure method. Use an app like Google Authenticator, Authy, or any compatible TOTP app on your phone.

Setup takes three steps:

1. Scan the QR code — Open your authenticator app, add a new account, and scan the QR code shown on screen. If your app cannot scan it, use the manual entry option to type in the secret key instead.
2. Verify the code — Enter the 6-digit code your authenticator app displays to confirm it is working correctly.
3. Save your backup codes — Ten one-time backup codes are generated. Download or copy them to a safe location. You must save these before you can finish setup.

Important: Store your backup codes somewhere safe and offline — not on your computer. If you lose access to your authenticator app and have no backup codes, you may be locked out of your account.

Email Verification

When this method is enabled, a 6-digit code is sent to your registered email address each time you log in from a new device. This method requires no setup wizard — simply click to enable it. Codes expire after 10 minutes.

Backup Codes

Ten one-time backup codes are generated automatically when you set up the Authenticator App method. Use them if you ever lose access to your authenticator app.

• Each code can only be used once.
• You can regenerate a new set of codes at any time — doing so permanently invalidates the old ones.
• A warning is displayed when you have 2 or fewer codes remaining.

Tip: Regenerate your backup codes after using one, so you always have a full set available.

Disabling 2FA

To disable two-factor authentication, you must enter your current password to confirm. Disabling 2FA removes all active methods, your TOTP secret, and all backup codes.

Trusted Devices

When logging in with 2FA active, you can check Trust this device to skip the 2FA check on future logins from the same browser. Trusted devices are listed on the 2FA page, and you can revoke any of them at any time. You cannot revoke the device you are currently using — log out and back in from another device to do so.

Game Device Lock

Device Lock is a game-level security feature available at /account/security/devices. When enabled, only approved devices (computers) can connect to the game server using your game account credentials. Even if someone obtains your game login and password, they cannot play your characters without your explicit approval.

Enabling Device Lock

Each of your game accounts has an individual Device Lock toggle. Enable it per account from the Devices page. Once enabled, any new device attempting to connect will be automatically blocked and will appear as Pending in your security panel.

Approving and Rejecting Devices

When a new connection attempt is blocked, you will see it listed on the Devices page with its device ID and IP address. You can then:

• Approve — Allow the device to connect freely going forward.
• Reject — Permanently block the device from connecting.

Each game account supports a maximum of 5 approved devices.

Device States

State	Color	Meaning
Pending	Amber	A new connection attempt is waiting for your decision.
Approved	Green	The device is allowed to connect to the game.
Rejected	Red	The device is blocked from connecting.

Important Rules

• Removing an approved device starts a 24-hour cooldown before you can approve any new devices on that account.
• Re-approving a previously rejected device requires email verification — a 6-digit code will be sent to your email address.
• If any of your game accounts have pending devices, an amber notification badge appears in the sidebar to remind you.

Important: Keep Device Lock enabled on all your game accounts, especially those with high-level characters and valuable equipment. It is your strongest defense against unauthorized access to the game.

Changing Credentials

Update your email address or password at /account/security/credentials.

Change Email

1. Enter your new email address and your current password.
2. A confirmation email is sent to the new email address. The link is valid for 24 hours.
3. Click the confirmation link in that email to finalize the change.

If a change is already pending and you change your mind, you can cancel it from this page. Once confirmed, you will be logged out from all devices and must sign in again with the new email.

Change Password

1. Enter your current password.
2. Enter your new password and confirm it.
3. Click Save.

Password requirements: at least 8 characters, including an uppercase letter, a lowercase letter, a number, and a special character. After saving, all active sessions are invalidated and you will be redirected to the login page.

Tip: Use a password that is unique to L2 Draco — do not reuse passwords from other games or services.

Linked Accounts

Connect external accounts to your L2 Draco profile at /account/security/linked-accounts.

Discord

Linking your Discord account lets you log in via Discord and automatically use your Discord avatar as your profile picture if you have not set one.

To link Discord:

1. Click Link Discord.
2. You will be redirected to Discord to authorize the connection.
3. After authorizing, you are returned to L2 Draco and your Discord username appears on the page.

To unlink Discord, click Unlink and confirm the action.

Important: If your account was originally created using Discord sign-in and you have never set a password, you must set a password before you can unlink Discord. Otherwise you would have no way to log in.

Security Best Practices

Following these recommendations gives your account the strongest possible protection:

• Enable 2FA with the Authenticator App — This is the most secure 2FA method. Authenticator apps are not affected by SIM swapping or email compromise.
• Save your backup codes somewhere offline — Write them down or print them and store them somewhere safe, not on your computer or in a cloud note.
• Enable Device Lock on all game accounts — This prevents anyone from playing your characters even if they have your game credentials.
• Use a strong, unique password — At least 8 characters with a mix of uppercase, lowercase, digits, and special characters. Never reuse passwords.
• Check your Recent Activity regularly — Review your login history for any suspicious activity you do not recognize.
• Revoke trusted devices you no longer use — Remove old devices from your trusted list to keep it current and secure.