Keeping your account safe

Your account holds your drafts, your published work, and your community. A few simple habits keep all of it yours.

Never paste code into your browser console

Every browser has a hidden developer console, a tool built for engineers. If you open it, you may notice a friendly note from Lupin and a warning in red.

That warning is there for a reason. A common scam tells you to copy something and paste it into the console to “unlock free Pro,” “see who viewed your profile,” or “recover a locked account.” None of those features work that way. Pasting code there runs it with full access to your logged-in account. A stranger can take over your account and your writing in seconds.

The rule is short: never paste anything into the browser console unless you wrote it yourself and know exactly what it does. Inkbreaker will never ask you to.

How to spot a scam

Real Inkbreaker features live inside the app, in menus and buttons you can see. Be suspicious of anyone, in a comment, a message, the forum, or an email, who asks you to:

• Paste code anywhere to “enable” something.
• Visit an outside site to “verify” your account or claim a prize.
• Share your password, a login link, or a one-time code.
• Move the conversation off Inkbreaker to “finish” a payment or a deal.

When something feels off, it usually is. You can report it from the Report option on any profile, post, or message.

Sign in safely

• You can sign in with Apple, Google, Discord, or Microsoft, with your email and a password, or with a passkey. We never ask for your password in a chat, a comment, or an email.
• Check the address bar before you sign in. The real site is inkbreaker.com.
• If you share a computer, sign out when you finish.

Two-step verification

Two-step verification adds a second lock: signing in takes your password plus a 6-digit code from an authenticator app on your phone (Google Authenticator, 1Password, and Authy all work). Even if your password leaks, nobody gets in without your phone.

To turn it on, go to Settings › Sign-in and security, choose Turn on two-step verification, and scan the QR code with your authenticator app. If you cannot scan it, for example on the phone that holds the app, type the key shown under the code into the app instead. You confirm it is you with your password or, if you sign in with Apple, Google, Discord, or Microsoft, by signing in with that provider once more. Once it is on, every sign-in asks for a code, whichever way you sign in.

When you finish setup we show you a set of backup codes, once. Each code signs you in a single time if you lose your phone. Store them somewhere safe, like a password manager. The page shows how many you have left and warns you when only a few remain. Choose New backup codes for a fresh set whenever you want; the old set stops working.

You can check Trust this device for 30 days when you enter a code, so your own devices don’t ask again every time.

Passkeys

A passkey signs you in with your device’s own lock: your face, your fingerprint, or your PIN. There is nothing to type and nothing anyone can trick you into giving away. In Settings › Sign-in and security, choose Add a passkey and follow your device’s prompt. Add one on each device you use, and rename or remove any of them from the same list. Next time, choose Sign in with a passkey on the sign-in page.

Where you are signed in

The same page lists every browser and app signed in to your account under Where you’re signed in, with when each was last active. Sign out of any you don’t recognize, or choose Sign out everywhere else to keep only the device in front of you.

The top of the page sums up your account at a glance: whether two-step verification is on, how many passkeys and ways to sign in you have, and how many devices are signed in. If one lost password or phone could lock you out, it suggests what to add.

When a team asks for two-step

A team’s owner can turn on Two-step for everyone in the team’s settings, under Protection. Members then need two-step verification or a passkey to work in that team. If you have neither, the team shows a page that takes you to your settings to turn one on. Your own account and your own work are untouched.

If you think your account was reached

Change your password from Settings › Sign-in and security. Changing it signs out every other device at the same time, so anyone using your account loses access on the spot. Then check Where you’re signed in on the same page and sign out of anything you don’t recognize. If you shared your Apple, Google, Discord, or Microsoft password anywhere, change that too, and consider turning on two-step verification above. If your writing was copied or your work was changed, see Protecting your work and reach out from the Support page. We can place a legal hold on stolen work and help you sort it out.

Your writing is yours. We will never ask you to give up control of it to keep it.