Use a unique password
Never reuse a password from email, banking, work, or another game. MapleTime staff will never ask you to send your password, PIN, or PIC.
How portal registration works
- The public API validates your request and anti-bot challenge.
- Your password is BCrypt-hashed before pending state is stored.
- Your verification link uses a hashed, single-use token.
- The queue contains only an opaque request reference.
- A private worker performs the minimum account operation.
The database has no public port. The content editor never receives database credentials.
Rankings
Rankings contain character name, level, job, fame, world, guild, and position. Staff and banned accounts are excluded. Email, account name, password hash, IP, MAC, HWID, and currency are never published.
Recovery
Email-based password recovery is not yet public. Existing first-login accounts often have no verified email, so recovery will only launch with an explicit, verified email-linking flow. Staff cannot recover an account from an unverified address.