Your account: sign-in, security and access

A HodlChip account is free and optional: you can always check out as a guest and follow an order with its number and email address. An account adds your order history, saved addresses that fill the checkout for you, a wishlist on all your devices and your saved PC Builder part lists.

Creating an account

Choose Account at the top of any page, then Create account. You need your name, an email address and a password of at least 8 characters. A short phrase of a few words is long, hard to guess and easy to remember; a password manager is even better. Passwords that appear in known data breaches are refused: we check the Pwned Passwords list by sending only the first five characters of a hash of your password, which does not reveal it. Your account is ready at once and you stay signed in.

If you forget your password

HodlChip sends no sign-in or reset links by email: those links are the favorite tool of phishing. If you forget your password, choose Forgot password? in the sign-in window, then Contact support, and write to us from the email address of your account. We check that the request really comes from you before helping you set a new password, usually within a few hours. Meanwhile your orders stay safe: you can follow them at Track order with the order number and email.

Two-step verification

With two-step verification on, signing in needs your password and a 6-digit code from an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password, Aegis or Authy. A stolen password alone can no longer open your account.

1. In your account, open Sign-in & security and choose Set up two-step verification.
2. Confirm your password, then scan the QR code with your app, or type the key shown next to it.
3. Enter the code your app shows for HodlChip. From now on, every sign-in asks for a fresh code.

Each code works once and changes every 30 seconds. If codes are refused, check that your phone sets its date and time automatically. Most authenticator apps can back up their codes or move them to a new phone: turn that on in the app.

Lost your phone? Contact support from the email address of your account. Once we have checked that the request is yours, we turn two-step verification off so that you can sign in and set it up again on your new phone.

How sign-in is protected

• Passwords are never stored in readable form, only as Argon2id hashes. Authenticator secrets are stored encrypted.
• Sign-in and sign-up forms carry a Cloudflare Turnstile security check that stops automated attacks, usually without asking you anything.
• After 10 wrong passwords or codes in a row, sign-in to the account pauses for 15 minutes, even with the right password.
• The sign-in cookie is random, unreadable by scripts on the page, and only a hash of it is stored on our servers. Without Keep me signed in, it ends when you close your browser or after 12 hours without activity; with it, after 30 days without activity, and at the latest 90 days after you signed in.
• Changing your password signs you out on every other device.

Signed-in devices and security activity

Sign-in & security lists the devices where your account is signed in, with the browser, the approximate location, the IP address and the last activity. You can sign out any of them, or all of them at once. Below, the security activity shows recent sign-ins, failed attempts and changes to your password and two-step verification. If you see something you don't recognize, sign out the device and change your password.

Download or delete your data

In Sign-in & security, Download gives you everything your account holds as a JSON file: profile, addresses, orders, wishlist, saved builds, devices and security activity. Delete account erases your profile, addresses, wishlist, saved builds, devices and security log at once and signs you out everywhere. Your orders stay on record, as accounting and warranty rules require, but are no longer linked to an account. Details are in our Privacy policy.

What we will never ask

We will never ask for your password or an authenticator code, by email, chat, phone or any other way. You only ever enter them on hodlchip.com. See Protect yourself from phishing.