Two-Step Login & Account Security
Phantasia supports optional two-step login to protect your account with additional security. Enable this feature to prevent unauthorized access through authenticator apps, one-time recovery codes, and staff-assisted recovery options.
Supported Two-Step Methods
- Authenticator App (TOTP): Time-based one-time passwords from your phone or authenticator app
- One-Time Recovery Codes: Single-use backup codes in case you lose access to your authenticator
- Staff-Assisted Reset: Manual identity verification by game staff if needed
Enabling Two-Step Login
To enable two-step login on your account:
- Log into your character in the game
- Navigate to Account Options → Two-Step Login
- Follow the setup prompts
- Scan the QR code displayed in your client (works in Electron and web clients)
- Or manually enter the Base32 key into your authenticator app
- Confirm a six-digit code from your authenticator to complete setup
- Store your recovery codes in a safe location
Authenticator Requirements
Your authenticator app must support:
- Time-based codes (TOTP protocol)
- Six-digit codes
- 30-second refresh period
Most modern authenticators meet these requirements, including:
- Google Authenticator
- Microsoft Authenticator
- Authy
- FreeOTP
Recovery Codes
Recovery codes are shown once during setup and should be stored safely. Each recovery code can be used once if you:
- Lose access to your authenticator device
- Change phones or authenticator apps
- Need to reset your account
Important: If you lose your recovery codes and no longer have access to your authenticator, you may need staff-assisted recovery through manual identity verification.
Staff-Assisted Resets
If you lose access to both your authenticator and recovery codes, the game staff can assist with account recovery. This process requires:
- Proof of account ownership through our standard identity verification procedure
- Communication with game staff
Use the /mfareset command (staff only) to initiate a reset after confirming the account holder's identity.
A successful reset:
- Immediately disables the authenticator
- Invalidates every recovery code
- Requires re-enrollment of two-step login
All reset actions are logged in the plain-text log/mfa audit file for security tracking.
Disabling Two-Step Login
To disable two-step login:
- Log in with your two-step code when prompted
- Navigate to Account Options → Two-Step Login
- Select the option to disable two-step login
Your authenticator and recovery codes will no longer be required for login.
Password Security
When you create or change your password in Phantasia:
- New passwords: Use Argon2id hashing with per-password random salt for maximum security
- Existing passwords: Automatically upgraded to Argon2id after successful login
- Legacy support: Older MD5 and SHA-256 passwords are upgraded automatically and transparently
Before upgrading your server, we recommend backing up your database. Rolling back after a password-system migration requires restoring both the database backup and the previous server binary.
Encryption Key Management
The server uses a stable 32-byte encryption key to protect two-step login data. This key must be configured in the server
environment as PHANTASIA_TOTP_KEY. If you're running a private server:
- Generate a key with:
openssl rand -hex 32 - Set the 64-character hexadecimal value as
PHANTASIA_TOTP_KEY - Keep this key private and back it up securely
- Use the same key across server restarts and instances
- Important: Losing or changing this key prevents authenticator verification for enrolled accounts. Recovery codes and manual staff resets remain available.