01
Email and password
The address you registered with, and a case-sensitive password. Let your password manager fill it if it offers — mistyped passwords account for more failed sign-ins here than every other cause combined.
Your strategies, open positions and balance are behind here.
Opening an account takes about a minute, needs no card, and starts you on a simulated balance.
Three steps, and roughly twenty seconds once two-factor is enrolled.
01
The address you registered with, and a case-sensitive password. Let your password manager fill it if it offers — mistyped passwords account for more failed sign-ins here than every other cause combined.
02
Six digits from your authenticator, or a tap on your hardware key. Codes roll every thirty seconds, so a rejected code usually means you were on the boundary — wait for the next one rather than retyping it.
03
Strategies, open positions and balance, all in view. Accounts open on the simulated balance and stay there until you deliberately move them; going live is never something that happens by default.
There is no desktop terminal to install and no exchange account to connect — the whole platform lives inside the browser session. Once you are in you can:
Use the reset link on the platform's sign-in screen. A single-use link goes to the address on the account and expires after an hour. If it has not arrived in a few minutes, check spam before requesting another — each new request invalidates the last one, so asking repeatedly is what usually keeps people locked out.
Use one of the recovery codes issued when you enrolled. If those are gone too, contact support from the email address on the account and we will take you through identity verification. We cannot switch two-factor off on request, and that refusal is precisely what makes it worth having on an account that can move money.
Check caps lock, and check your password manager has not filled credentials saved for a different site. After several failures the account rate-limits itself for its own protection — wait a quarter of an hour rather than continuing. If it still fails after that, reset rather than keep guessing.
This site is the public one. The platform sign-in lives on our application subdomain, and you should confirm the address bar and certificate before entering anything anywhere. We will never ask for your password, your six-digit codes or your recovery codes — not by email, not in chat, not on a call. Anyone who does is not us.
Yes, and you should not on any machine that is not yours. Your security settings list every active session with its device and location, and you can end any of them from there — worth a look occasionally even if nothing seems wrong.
An account that can place orders deserves more care than most. Give it a password used nowhere else, leave two-factor enrolled, and allowlist your withdrawal addresses — that last one is what stops funds leaving even if someone else has your password, because a new destination cannot be added and used in the same session.
How credentials and device history are stored is set out in our privacy policy, and the people accountable for it are described on the about page.