Accounts vault
Every secured account lands in the vault: stats, credentials, launcher login, saved sessions, recycle bin. Filter it like a stock list, not a folder of notes.
The vault
Accounts is the stock list. Filter by cape, rank, tags, Hypixel / SkyBlock / Donut stats, value. Sort by those same paths. Totals only appear when you ask for them. Cards stay dense on purpose — an 800-row list cannot wear a blur on every tile.
Open a card for credentials, live 2FA, Microsoft profile, and the 3D skin. Secrets stay masked until you reveal them. Copy still uses the real value.
Stats come from stored summaries (Hypixel, SkyBlock, DonutSMP). A refresh that fails a source keeps the last good numbers instead of writing zeros. Donut playtime is stored as raw milliseconds — the UI already formats it; do not paste the raw field into a listing. A stats fetch can also store whether the player is in a Hypixel game, and Hypixel social links. The account page shows a Socials tab only when at least one link is stored. The Mail tab shows Outlook subjects and previews when a secure saved them. Public share pages omit both.
Cards can carry tags the secure writes. At Risk when a requested step failed. In a Family when a Microsoft family could not be left. Minor when a readable birth date is still under 18 and was not replaced. Newly bought when the Minecraft account or a Java or Bedrock order is under seven days old. Can't Chat when the Minecraft Chat privilege is Off. Removing At Risk sticks. The others are rewritten on the next secure.
Launcher login
On an owned account card, Sign in launcher takes the eight-character Microsoft device code from Feather, Lunar, Prism, the official launcher, Switch, or a browser. We finish remote-connect as that stored account. You do not type a password on sten.wtf for this. Select several cards and the same action walks through each account with one code at a time.
Start sign-in on the client
Stop when it shows the code.Paste it on the card
Eight characters. Hyphens are fine.We verify
Security-email code if one is stored (Microsoft rejects email+password on this path most of the time); otherwise password then stored TOTP. Recovery codes are never used here. Unverified launchers get the extra consent prompt accepted for you.Longer version: launcher login post.
Sessions and checks
Session Manager on the Accounts toolbar stores up to 40 Minecraft sessions. Paste a Minecraft SSID, or a Microsoft access token. The list never shows the token back. A live vault session, or one you saved, can change the Minecraft name or copy another player’s skin.
If the vault session has expired, refresh it from the banner, the selection bar, or the account page. That uses a cached session, then the stored Microsoft sign-in, the same way Quarantine does. The page does not show the raw token.
Refresh stats on the selection bar updates Hypixel, SkyBlock, and Donut numbers for every selected account that has a Minecraft name. Stop keeps the accounts that already finished. Each card’s three-dot menu still refreshes that one account.
The toolbar Check validity takes a Microsoft email and reports lock, compromised, and blocked, plus masked proofs. It does not sign in. On an account card, the three-dot menu Check validity asks for a hard or soft check of that account. Soft check does not sign in. Without an authenticator it also checks that the security email’s first two letters and domain still match. Hard check signs in and confirms the account is unchanged. An account with a security key always uses the hard check. Remember a choice on this browser. The same menu shows Using hard checks or Using soft checks when a choice is saved, and that row changes it. It needs a licence.
Recycle bin
Delete from the dashboard moves the row into a recycle bin for 7 days, then it is gone. Restore from the Recycle Bin drawer on Accounts. Select any number of rows and restore them together. Search by name, email, or ID, and sort by newest, oldest, or name. If you re-secured the same Microsoft account in the meantime, restore refuses rather than clobber the live row. Failed-flow leftovers and the Discord AI’s delete tool are still hard deletes — those were never vault rows you meant to keep.
Share and export
Share links (when enabled on your account) mint a public vault page — identity, masked credentials, live 2FA, inbox drawer. White-label links can retint the glass; they cannot break it. Export dumps what you selected. Import is the other direction for stock you already hold.
Access log
Every vault row keeps an activity log: who opened it, copied a field, exported it, minted a share link, or used InstaLogin, and when. Open Activity on the account page.
Share links have their own visitor log — masked IP and city — plus a view count on the link card and on the public page itself. Lock-screen hits do not count; opening the vault does.