Account security: Item Lock, 2FA and anti-rooking
Equipment locked by code, 2FA at login and an automatic lock for when the password has already leaked.
The problem in regular Tibia
A stolen account is the most common dead end on a private server, and the most poorly handled. When it happens, the character is emptied in minutes and the player finds out hours later — usually with no log, no backup and no recourse at all. The two usual defenses, a strong password and hoping, are not enough: the password tends to leak outside the game.
How it works here
- Item Lock: lock your equipment with a code sent by email. Confirming the code lets you lock and unlock for 1 hour; after that it is asked for again.
- A locked item cannot be dropped, traded, placed in a parcel, sold on the Market or sent to the Stash.
- Two-factor authentication at login.
- Anti-rooking protection: a level 700+ character that loses more than 20 levels in 12 hours is disconnected and needs 2FA by email to come back. It unlocks by itself after 12 hours.
Why it was designed this way
They are layers with different purposes, and the last one is the one that matters most. 2FA prevents entry; Item Lock prevents the items from leaving; anti-rooking assumes the first two can fail. It does not ask whether the access is legitimate — it looks at the effect, a drop in level that no player causes on purpose, and locks. It is the defense that works in the scenario where the intruder is already inside.
Frequently asked questions
What exactly does Item Lock prevent?
A locked item cannot be dropped, traded, placed in a parcel, sold on the Market or sent to the Stash.
Do I need the code every time I want to unlock?
No. Confirming the code opens a window of 1 hour to lock and unlock freely; after it the code is asked for again.
What is anti-rooking protection?
A level 700+ character that loses more than 20 levels in 12 hours is disconnected and needs 2FA by email to come back. The lock lifts by itself after 12 hours.
See also
You can try it at no cost
Free account, our own client, three worlds. If you don't like it, you lost an afternoon — not a character.