this is bussin — looks legit
Final verdict: Valid
Everything here gives no reason to worry. Carry on as normal, but stay alert as always.
Scan coverage
https://auth.hackclub.com/welcome?return_to=https%3A%2F%2Fauth.hackclub.com%2F • 10/25/2026, 3:15:55 AM • HTTP 200
How the score was calculated
Traffic between your browser and this server is encrypted over TLS.
The final page URL is served over HTTPS (https://auth.hackclub.com/welcome?return_to=https%3A%2F%2Fauth.hackclub.com%2F).
Why it matters: Encryption prevents network eavesdroppers from intercepting your data or tampering with page content in transit.
Fix: Note that while HTTPS encrypts traffic, it does not verify whether the site's content or business is trustworthy.
No password input fields were detected in the page HTML.
No <input type="password"> tags found in static HTML.
Why it matters: The page does not appear to solicit user account passwords.
Fix: None required.
No Content-Security-Policy header was sent by the server.
Content-Security-Policy header absent.
Why it matters: A CSP provides defense-in-depth against code injection and unauthorized framing.
Fix: Deploy a Content-Security-Policy header.
The domain uses a standard top-level domain and natural length.
Host 'auth.hackclub.com' exhibits standard naming structure.
Why it matters: Domain structure conforms to typical human-selected naming conventions.
Fix: None required.
We did not find aggressive pressure tactics or typical prize scam language.
Zero tracked high-pressure scam keyword phrases matched.
Why it matters: The text does not show obvious automated scam indicators.
Fix: None required.
HSTS is present but has a short duration.
Strict-Transport-Security max-age is only 604800 seconds.
Why it matters: Short max-age durations reduce long-term protection against connection downgrades.
Fix: Consider extending HSTS max-age to at least 1 year (31,536,000 seconds).
X-Content-Type-Options is set to 'nosniff'.
X-Content-Type-Options: nosniff.
Why it matters: Prevents browsers from MIME-sniffing a response away from the declared content-type, blocking script execution disguised as images or text.
Fix: Properly configured.
The site controls whether it can be embedded inside iframes on other domains.
Framing restricted via X-Frame-Options: SAMEORIGIN.
Why it matters: Prevents clickjacking attacks where a malicious site disguises the page inside an invisible frame.
Fix: Framing defense properly active.
The site links to a readable Privacy Policy.
Fetched https://auth.hackclub.com/docs/privacy (HTTP 200, 10081 bytes). Standard policy text retrieved.
Why it matters: Available policies allow visitors to understand data collection, terms of use, and legal rights.
Fix: Review the policy if you plan to share sensitive or personal information.
The site links to a readable Privacy Policy.
The site links to a readable Privacy Policy.
<!DOCTYPE html>
<html data-theme="light">
<head>
<title>Welcome — Hack Club Auth</title>
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="mobile-web-app-capable" content="yes">
<meta name="csrf-param" content="authenticity_token" />
<meta name="csrf-token" content="GB4Xl2zWl8_UbGqj89xMntwQlu-Ut5tHilQv8Dj_LXazAw3OaE1GUFHkwM05I5VPlFdiD88U8Rx9vln7iPyfaQ" />
<script>
(function() {
const systemPrefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
const defaultTheme = systemPrefersDark ? "dark" : "light";
const savedTheme = localStorage.getItem("theme") || defaultTheme;
document.documentElement.dataset.theme = savedTheme;
})();
</script>
<link rel="icon" href="/icon.png" type="image/png">
<link rel="icon" href="/icon.svg" type="image/svg+xml">
<link rel="apple-touch-icon" href="/icon.png">
<link rel="stylesheet" href="/assets/application-CqjJMmgB.css" />
<script src="/assets/application-wxnxa9zY.js" crossorigin="anonymous" type="module"></script><link rel="modulepreload" href="/assets/htmx.min-DQeHE3qo.js" as="script" crossorigin="anonymous">
</head>
<body class="auth-layout" hx-headers='{"X-CSRF-Token": "rJTWnWDeCCnH04bZb0z6HqwNHnKxCCqelGkxt5SQY7MHiczEZEXZtkJbLLelsyPP5ErqkuqrQMVjg0e8JJPRrA"}' hx-boost="false">
<button id="lightswitch" class="lightswitch-btn" type="button" aria-label="Toggle theme">
<span class="lightswitch-moon"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewbox="0 0 32 32" style="display: inline-flex; vertical-align: middle;"><path d="M26.704 22.1c.555-.736-.263-1.645-1.166-1.46-.783.16-1.593.245-2.423.245-6.627 0-12-5.373-12-12 0-.83.084-1.64.245-2.423.185-.903-.724-1.721-1.46-1.166a11.982 11.982 0 0 0-4.785 9.59c0 6.627 5.373 12 12 12 3.92 0 7.4-1.88 9.59-4.786z"></path></svg></span>
<span class="lightswitch-sun" style="display: none;"><svg xmlns="http://www.w3.org/2000/svg" height="16" viewbox="-70 -740 1100 500" width="16" fill="currentcolor" style="display: inline-flex; vertical-align: middle;">
<path d="M480-373q45 0 76-31t31-76q0-45-31-76t-76-31q-45 0-76 31t-31 76q0 45 31 76t76 31Zm0 66q-72.85 0-122.92-50.08Q307-407.15 307-480t50.08-122.92Q407.15-653 480-653t122.92 50.08Q653-552.85 653-480t-50.08 122.92Q552.85-307 480-307ZM80-447q-13.5 0-23.25-9.76T47-480.03q0-13.51 9.75-23.24Q66.5-513 80-513h100q13.5 0 23.25 9.76t9.75 23.27q0 13.51-9.75 23.24Q193.5-447 180-447H80Zm700 0q-13.5 0-23.25-9.76T747-480.03q0-13.51 9.75-23.24Q766.5-513 780-513h100q13.5 0 23.25 9.76t9.75 23.27q0 13.51-9.75 23.24Q893.5-447 880-447H780ZM479.97-747q-13.51 0-23.24-9.75Q447-766.5 447-780v-100q0-13.5 9.76-23.25t23.27-9.75q13.51 0 23.24 9.75Q513-893.5 513-880v100q0 13.5-9.76 23.25T479.97-747Zm0 700q-13.51 0-23.24-9.75Q447-66.5 447-80v-100q0-13.5 9.76-23.25t23.27-9.75q13.51 0 23.24 9.75Q513-193.5 513-180v100q0 13.5-9.76 23.25T479.97-47ZM245.46-669.77l-57.61-55.85q-9.85-10.61-9.73-23.26.11-12.66 9.96-23.27 10.38-10.62 22.65-10.62 12.27 0 23.65 10.62L291-715.31q10.38 10.62 10.38 23.16 0 12.53-10 23.15-9 10.62-22.15 10.12-13.15-.5-23.77-10.89Zm480.16 481.92L669-244.69q-10.38-10.62-9.88-22.77.5-12.16 9.88-23.54 9.23-10.62 22.08-10.12 12.84.5 23.46 10.89l57.61 55.85q9.85 10.61 9.73 23.26-.11 12.66-9.96 23.27-10.38 10.62-22.65 10.62-12.27 0-23.65-10.62ZM669-668.62q-10.62-9-10.12-22.15.5-13.15 10.89-23.77l55.85-57.61q10.61-9.85 23.26-9.73 12.66.11 23.27 9.96 10.62 10.38 10.62 22.65 0 12.27-10.62 23.65L715.31-669q-10.62 10.38-23.16 10.38-12.53 0-23.15-10ZM187.85-187.68q-10.62-10.78-10.62-23.05 0-12.27 10.62-23.65L244.69-291q10.62-10.38 22.77-9.88 12.16.5 23.54 9.88 9.85 9.23 9.35 22.08-.5 12.84-10.12 23.46l-55.85 57.61q-11.38 10.62-23.65 10.5-12.27-.11-22.88-10.33ZM480-480Z"></path>
</svg>
</span>
</button>
<div class="auth-page">
<div class="auth-flash-wrapper">
<span id="async_flash"></span>
</div>
<div class="auth-container"><div class="auth-card"><header><h1>Hack Club Auth</h1><small>One account for Slack, Hack Club, and beyond.</small></header><div style="margin: 3rem 0;"><form action="/login?return_to=https%3A%2F%2Fauth.hackclub.com%2F" method="post"><input type="hidden" name="authenticity_token" value="uCSoINv-QZN6L_yfoOZAbphYZopzFUPhyOBUgInOSXkTObJ532WQDP-nVvFqGZm_0B-Saii2Kbo_CiKLOc37Zg"><div style="margin-bottom: 1rem;"><input type="email" name="email" placeholder="orpheus@dino.mail" required autocomplete="email" style="width: 100%;"><small style="color: var(--muted-color); display: block; margin-top: 0.5rem;">This'll be the email you use across Hack Club. We recommend using your personal email. If you already have a Hack Club account, just put your existing email in here :-)</small></div><button type="submit" class="primary" style="width: 100%; margin-top: 1rem;">Continue →</button></form></div><footer class="welcome-footer"><p>If you're having trouble logging in, please email <a href="/cdn-cgi/l/email-protection#ea8b9f9e82aa828b898189869f88c4898587"><span class="__cf_email__" data-cfemail="741501001c341c15171f171801165a171b19">[email protected]</span></a>.</p><p class="welcome-links"><a href="/docs/privacy">Privacy</a> • <a href="/docs/terms-of-service">Terms</a> • <a href="/docs/contact">Contact</a></p><span class="welcome-version">Build <a href="https://github.com/hackclub/auth/commit/6ba78971cb22b091794ab88a19f1b84449d2fdc3" target="_blank">6ba78971</a> from 1 day ago</span></footer></div></div>
</div>
<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>