Your account is one key for everything

A WolfTeam Legacy account is a single identity. The same username and password sign you in to the Windows launcher, the website and the game itself, with one inventory and one Gold balance behind them. That convenience is exactly why account safety matters: whoever holds your credentials holds everything, from your earned weapons to your place on the leaderboard. This guide explains in plain terms how the server protects your account today, and the small set of habits that keep it in your hands alone.

Creating the account: what is required

Registration happens on the website and takes about a minute. You pick a username of 3 to 20 characters using letters, numbers or underscores, provide an email address, and choose a password between 4 and 64 characters. The email must be a valid address, but the current flow does not send a confirmation message, so your account is active immediately. New accounts join as Recruit with 5,000 Gold, and the first time you start the game you choose a callsign: the name other players see in rooms and on public profiles. Your account username and email stay private.

How your password is stored

The server never stores your password as plain text. Passwords are kept as salted cryptographic hashes, which means even a full copy of the account database would not directly reveal your password. When you sign in, the password you type is checked against that hash. There is currently no self-service change-password page and no email-based password reset; password changes are applied by the team when you request one through the community channels. That design has a useful consequence: nobody, not even an attacker who controls your email address, can reset your password from the outside. It also means no password-reset emails exist, so any message claiming to come from WolfTeam Legacy and asking for your password is fake. The team will never ask for it.

Web sign-in and the 30-day session

Signing in to the website places a random session token in a protected cookie. The token is unreadable to page scripts, travels only over secure connections, and the server stores just a hash of it rather than the token itself. A session lasts up to 30 days, and every visit while signed in renews that window, so regular players rarely see the sign-in page again. Signing out is immediate and thorough: the session is revoked on the server side, so a browser left open on a shared computer can no longer do anything with it. On your own PC, staying signed in is convenient and safe; on a shared or family PC, use the sign-out button when you are done.

Automatic protection against password guessing

Sign-in attempts are rate-limited on the server: 30 attempts per IP address per minute and 10 attempts per account per minute, with new registrations limited to 5 per IP address per hour. Anyone trying to guess passwords hits that wall long before reaching meaningful combinations. If you mistype your own password several times in a row, you may simply see a short cooldown rather than an error message. Wait a moment and try again.

Privacy choices that stay yours

Website measurement, meaning analytics, is switched off by default. It runs only if you explicitly allow it, and the Do Not Track and Global Privacy Control signals from your browser disable it automatically. You can review or change this at any time on the privacy page. The cookies the site uses are few and purposeful: the session cookie that keeps you signed in for up to 30 days, a language cookie that only appears if you deliberately switch language and lasts up to a year, an optional measurement cookie if you allow it for up to 180 days, and a short-lived form token during registration that lives about an hour. Public profiles show your callsign and selected game statistics, never your email address or balances, and the staff player directory sits behind staff sign-in.

Scams that target free-to-play players

This server does not sell gameplay privileges. Gold and Wolf Coin are earned by playing, and the project says it plainly: Power is earned. Never sold. That promise has a security side: anyone offering purchased Gold, account sales or a free Gold generator is scamming you. The classic tricks ask for your login to receive a reward or point you to a mirror download. No reward ever requires your password. Download the game only from the official website and start it through the official launcher, because mirror copies are the classic way accounts get stolen.

A five-minute account checklist

Choose a long, unique password that you do not use on any other site or game. Enter your email correctly at registration; even though it is not verified today, it identifies the account for support. Sign out on shared computers and stay signed in on your own. Ignore every offer that involves handing over your credentials, no matter how free the Gold looks. If you ever suspect someone else used your account, ask the team for a password change as soon as possible. Your inventory was earned match by match, and five minutes of caution keeps it that way.

More from the field journal

← Explore the journal