Security
Account security at LootBox
Your account holds your balance and your inventory. We take protecting it seriously — and a few habits on your end go a long way.
How we protect your account
- All traffic is encrypted in transit with TLS 1.3.
- Passwords are hashed with a modern algorithm (Argon2id) — they are never stored in plaintext.
- Sessions expire after a period of inactivity, and you can review and revoke active devices any time.
- Sensitive actions (logins, withdrawals, security changes) are written to an audit log we monitor.
How you can protect yourself
- Use a strong, unique password — at least 12 characters, mixed case, digits, and a symbol.
- Turn on two-factor authentication. It's the single biggest upgrade you can make.
- Watch for phishing — LootBox will never ask for your password or 2FA code over email or chat.
Suspicious activity
If you notice a sign-in you don't recognise, an unexpected balance change, or a strange email claiming to be from us, get in touch right away — we'll investigate and lock the account if needed.