WHAT WE DO
Your website password is stored using a modern password hash, never in plain text and never as a bare MD5. Sessions are bound to your browser and can be revoked; if the account system detects a problem, it signs you out rather than guessing.
The website cannot reach the game database directly. It can only ask for a short, fixed list of things, over a private link. A website compromise therefore cannot dump the game's player data.
Email for account recovery is sent from our own mail system with SPF, DKIM and DMARC in place, so a forged "Jade Dynasty Mortal" message is much easier for your provider to reject.
WHAT ONLY YOU CAN DO
Use a password you use nowhere else. Account theft on private servers is overwhelmingly reused passwords from other leaked sites, not broken servers.
Keep your recovery email address current and secure. Whoever controls that mailbox can reset your account.
Never share your password with anyone claiming to be staff. We will never ask for it - not in Discord, not in a private message, not in game.
Download the client only from the links on this website. A client from an unofficial mirror can contain anything.
Be suspicious of any "vote for rewards" or "free coins" site that asks for your game password. Legitimate reward systems never need it.
IF SOMETHING LOOKS WRONG
Change your password first, then contact staff. Include when you last logged in successfully and anything unusual you noticed. Do not delete evidence - character and inventory history helps us reconstruct what happened.