Try it out

Register an account and see what actually gets stored — live, as you type. Everything on the right panel updates in real time. No plaintext. No readable data. Just hashes and encrypted blobs.

What you're about to fill in — and why

1
Nick (username)

Your public identifier. It gets hashed immediately — the database never stores it as readable text. Even if the database leaks, nobody can see what nick you chose.

2
Email

Used only for account recovery. Hashed the same way as the nick — never stored in plain text. Nobody reading the database can see your email address or use it for spam.

Coming soon: an option to remove email from the database entirely.
3
ID.me (your secret number)

This is the key piece. Pick a number you'll remember — minimum 4 characters. It does two things at once:

Verifies your identity — it's checked alongside your password as a second knowledge factor Selects the algorithm — it picks 1 of 1,024 ways to mix your password before hashing. This choice is never stored anywhere. Re-derived every login from your ID.me.

Think of it like this: even if someone steals the database and sees your password hash, they don't know which of 1,024 methods was used to create it. They'd have to try all of them. And your ID.me is hashed separately with Argon2id (slow hashing), so cracking that alone takes massive effort.

Important: ID.me is never stored in the database in any recoverable form. You must enter it every time you log in. There is no "forgot my ID.me" option. Remember it.
4
Password

The system strengthens any password internally — your ID.me, the salt, and the mixing algorithm all add layers. But I still recommend choosing a strong password. Here's why:

A leaked hash from another site can't be compared to yours here (different salt, different method, rotates every login) But a strong password is still your first line of defence — the harder it is to guess, the more all the other protections stack on top
Even a short password gets significant protection from the system. But longer and more complex = exponentially harder for any attacker, even in worst-case scenarios.
5
Your story (for recovery)

Write something personal — a real memory with specific names, places, and details. This is what your recovery questions will be drawn from if you ever lose access.

The story itself is never stored — only hashed fragments of meaningful words (names, places, objects) Common words (the, and, it, was) are ignored — only specific, meaningful words count The more specific your story, the more secure your recovery questions will be

After you submit:

→ Everything gets hashed and encrypted server-side
→ You'll see a 16-word seed phrase — copy it somewhere safe. It's shown once and never again. You need it for recovery.
→ Account created. Log in with your nick + ID.me + password. Watch the hash rotate.
Stored as a hash. Never in plain text.
Hashed. Used only for recovery. Never readable in the database.
Pick something you'll remember. Minimum 4 characters. This also selects which of 1,024 mixing methods is used for your password hash. ID.me is stored only as a slow hash (Argon2id) — impossible to reverse. The algorithm it selects (1 of 1,024) is never stored anywhere. You'll need to enter your ID.me every time you log in. There's no "forgot my ID.me" option. Remember it.
The system strengthens it internally — but stronger is always better. We recommend something you wouldn't use elsewhere.
Never stored as text. Only hashed fragments of meaningful words (names, places, objects). Common words are ignored.

What's actually in the database right now

This updates live as you type. Every field below is either hashed or encrypted. There is no way to reverse these back to your original input.

Start typing to see what would be stored.