One account. Everything that belongs to it.

These systems sign in here

Why one central account

Because a password you type in five places can be lost in five places.

Sign in once

Your account works across every connected service. No resets, no sticky notes, no two accounts under the same name.

You see who has access

Every application you granted access to is listed in your account, together with what it may see. One click takes that permission back.

Every device in view

See where you are signed in and end other sessions one at a time or all at once.

In plain words

What actually happens here

PopcornRP Group is where your account lives – and nowhere else. The forum, the shop, the wiki and the game servers no longer keep their own user management. When you sign in there, they send you here, you sign in once, and you are back where you started.

For you that means one password instead of five, and changing it changes it everywhere. For the connected services it means they never get to see your password at all. They receive only what you have explicitly allowed – and your account shows you at any time what that is.

The mechanism behind it is called PopcornRP Group Connect. It is the same principle behind every "sign in with account X" button you have ever used – we simply run it ourselves, for our own group, instead of handing your accounts to a corporation.

Three steps and you are in

Set it up once, then never think about it again.

Create an account

Username, email address, password. We ask for nothing else – everything beyond that is optional and can follow later.
Secure it

Set up a passkey or add a second factor. Either takes under a minute and makes all the difference if your password turns up somewhere else.
Sign in everywhere

From now on, every connected service needs one click on "Sign in with PopcornRP Group". No second password, no second sign-up.

Security that stays out of the way

The uncomfortable truth about passwords: most takeovers do not happen because someone was cracked, but because the same password already leaked somewhere else.

Passkeys

Sign in with a fingerprint, your face or a security key – no password at all. There simply is none left to steal.

Second factor

Authenticator codes and recovery codes. Knowing your password is not enough to get in.

Checked against known breaches

New passwords are checked against published breach data. What travels is never the password, only the first five characters of its hash.

You get told

Password changes, a sign-in from an unknown device, a change of email address – each one sends you a message. Also when it was not you. Especially then.

What your account holds

Not an empty profile with a sign-out button. This is the complete list of what you can set and see for yourself.

Profile

Display name, profile picture and cover image. Uploads are re-encoded on the server – what you upload never leaves it in the shape it arrived in.

Security

Change your password, manage passkeys, set up a second factor, generate recovery codes. Every one of those changes sends you a message.

Devices and sessions

Which devices are signed in, since when and roughly from where. End them one by one, or all but the current one.

Connected applications

Every service you have allowed something, with the individual sites behind it and what it may see. The permission can be taken back.

Activity

Sign-ins, password changes, new devices – as a history you can read yourself. Anything unusual is marked.

Data and deletion

Download everything that is stored. Or delete the account, with a grace period to change your mind.

The difference day to day

Five situations everybody knows – once without a central account, once with one. This is not about technology, it is about what you notice.

Every row is the same moment – once each way.

The situation	Without a central account	With PopcornRP Group
1 A new service	Register again, confirm another email, invent another password.	One click on "Sign in with PopcornRP Group". Done.
2 Changing your password	Everywhere, one at a time – and the one you forget is the one that bites later.	Once, here. Applies everywhere immediately.
3 A service gets breached	The password stored there is gone – and with it every account where you used the same one.	No password of yours is stored there. There is nothing to steal.
4 Keeping track	Nobody knows how many services they still hold an account with.	One list, in your account, visible and revocable at any time.
5 A new device	Sign in again on every service – and hope the password still works.	Sign in once. And you then see which other devices are signed in.
6 Changing your name	Everywhere, one at a time – and on the one service you forget you are called something else forever.	Once, in your profile. It follows everywhere at the next sign-in.
7 Leaving	Find every service and ask each one to delete you.	One deletion request. With a grace period, in case you change your mind.

Your data belongs to you

Not a slogan – a list of buttons that actually exist, and of deadlines that actually run out.

What is kept here

Username, email address and – if you enter them – display name, profile picture and cover image.
How you sign in: password as a hash, registered passkeys, second factor.
Your signed-in devices, so you can end them one by one.
Which applications you allowed what – and from which websites.

What is not kept here

Your password in the clear. What is stored is a hash the password cannot be recovered from.
Tracking across other sites. There are no advertising scripts and no counting pixels.
Data sold or lent out. There is no business model that would make that necessary.
What you do on the connected services. We see the sign-in, not your posts.

And for how long

Nothing stays "forever". These deadlines run out automatically, without anybody pressing a button.

Full IP address: 7 days
Sign-in history: 90 days
Read notifications: 90 days
Grace period after a deletion request: 30 days

Download everything we hold about you, as a machine-readable file.

Delete your account, with a grace period to change your mind. After that it is anonymised, not just hidden.

We only ask for what signing in requires. Everything else is optional.

For server operators and developers

Connect your own site

If you run something for the group, your site does not need its own user management. It can use this one.

PopcornRP Group Connect speaks OpenID Connect – stated here so you know which library you can use: any common one. There is a discovery document from which it fetches the endpoints itself; you enter one address, it does the rest.

For WordPress there is a ready-made plugin. It brings the sign-in button, links accounts permanently and takes over username, profile picture and cover image – including in BuddyPress, bbPress and GamiPress.

PopcornRP Group Connect

Discovery, key set, authorization code with PKCE, profile lookup, revocation and signed-out return.

WordPress plugin

Ready to install. Sign-in button, account linking through the immutable identifier, profile and cover image.

API and webhooks

A documented REST interface and webhooks for the events your site should hear about.

Connected in three steps

Without writing a line of cryptography yourself. Your library fetches the rest from the discovery document.

Create an application

In the developer area, with a name and a redirect address. You receive a client ID and a secret – the latter exactly once.
Enter one address

This single address is all your library needs. Endpoints, keys and supported methods it fetches itself.

https://popcornrp-group.com/.well-known/openid-configuration
Add the button

On WordPress the plugin does it. Everywhere else you redirect to the authorization endpoint and exchange the code for tokens.

What is secured along the way

Not as a promise, but as a list. Every point can be checked against the interface.

Asymmetrically signed tokens

Identity tokens are signed with RS256. We publish only the public key – so every connected site can verify that a token came from us, and none of them can issue one. With a shared secret, exactly that would be possible.

PKCE, mandatory

Every request carries a proof only its sender can redeem – as a SHA-256 digest, never in the clear. Intercepting the code on the way gets you nothing. Without that proof we refuse; it cannot be switched off.

Access that renews itself

A refresh token is valid exactly once. It is exchanged on every use – and presenting a spent one again is proof that somebody has been listening in: the whole chain is dropped, not just that one token.

Secrets we do not know ourselves

An application secret is shown exactly once – when it is created. Stored is only its hash and the last four characters for recognition. Lost therefore really means lost: we cannot hand it out, only issue a new one.

Encrypted on disk

Second-factor secrets, passkey keys, stored phone numbers and webhook secrets sit encrypted in the database. Getting hold of a backup gets you nothing on its own.

Signed deliveries

Every webhook carries an HMAC-SHA256 signature over the timestamp and the raw body. Your site can verify that the message really came from us and was not altered on the way.

Passwords that are stored nowhere

Only a deliberately slow hash is stored, never the password. New passwords are additionally checked against published breaches – what travels is the first five characters of a hash, never the password itself.

Sessions that actually end

An ended session is really ended, not merely marked as ended. And signing out at a connected site can take the session here with it – in both directions.

The API documentation and the developer area are open to signed-in accounts. Creating one takes a minute.

Sign in and get started

Questions that come up often

If something is missing: the account area answers most of these again, right where they matter.

1. The basics

Do I need a separate account for every service?

No. That is the whole point. One account covers every connected service – signing in there sends you here, you sign in once, and you are back.

Does this cost anything?

No. There is no advertising, nothing is passed to third parties, and there is no paid tier that could do more.

Which languages is the site available in?

Currently Deutsch and English. Which one you see is decided by your browser on the first visit – switch it at the top right, and the choice sticks, including on the sign-in pages of the connected services. When a language is added, it appears there by itself.

2. Account and security

Do I still have to remember a password?

Not if you set up a passkey. You then sign in with a fingerprint, your face or a security key, and there is no password left that could be stolen.

Can I delete my account again?

Yes, yourself and without having to ask. After the request there is a grace period in which you can still change your mind. After that the data is anonymised – not merely hidden.

I cannot get into my account any more. Now what?

Use "forgot password" to set a new one. If you set up a second factor and lost the device, the recovery codes you were given during setup will get you back in. Keep them somewhere that is not that same device.

What does a service see about me?

Only what you allowed it the first time – as a rule your username and an immutable identifier, often the profile picture as well. It never sees your password, and your email address only if you explicitly release it. Your account lists, for each application, what it receives.

3. Practical matters

What happens to my existing logins?

The first time you sign in to a service through PopcornRP Group, your account there is linked to this one. Your posts, purchases and settings stay where they are.

Why does one application list several websites?

Because an operator can run several sites under the same application. You then see each site you signed in from. A revocation, however, applies to the whole application – the permission belongs to it, not to the individual site.

One account. And then quiet.

Created in a minute, with a username, an email address and a password. Everything else is optional and can follow later.

Create your account I already have one

Free, no advertising
Done in a minute
Deletable at any time