When you'd need one
An LCT account is for the LCT platform only. You'd need it to save places or post in the LCT community. Mark works on your photos in the browser and needs no sign-in. Zlens and MuseFrame have their own accounts, not shared with LCT.
Signing up takes an email and a password, and so does signing in. No SMS codes, no third-party logins.
Why the address says "passwordless"
Because this page started out describing a different design. Early on, LCT planned one-time email codes with no password, and this guide was written for that.
A product decision on 2 September 2026 removed that design entirely. The backend now keeps only email sign-up and email-and-password sign-in. The code-login and third-party handlers, routes, settings and admin switches were deleted, and the matching database tables were dropped in the same migration, marked as irreversible.
The address stayed so existing links keep working. The content has to match the facts, so the whole guide was rewritten.
How the password is stored
The server never stores your password, or anything that could turn back into it. The database holds a derived value.
The derivation uses Argon2id, a function built to make mass guessing expensive. Each guess costs memory as well as time, so throwing graphics cards at it doesn't help much.
Memory, iterations and parallelism are tuned on the actual machine, with a hard floor. If the configuration falls below the floor, the service refuses to start instead of quietly running with weak settings. Every account also gets its own random salt, so two people with the same password end up with completely different records.
Even if the whole database were stolen, all anyone would have is derived values. Recovering one person's password means guessing one at a time, paying the full cost every time.
How sessions renew
Signing in doesn't give you one long-lived token. You get two credentials on separate clocks: a short-lived access credential and a refresh credential for renewal. Dropping offline, switching networks or closing the tab and coming back are all handled by renewal, so you don't type your password again. The access credential is short-lived, so a stolen one isn't much use for long.
Refresh credentials are tracked by session family, so sessions on different devices are independent and any one of them can be revoked on its own. Each account also carries a credential version. Changing your password bumps it, and every credential issued before stops working.
Every action has its own limit
Sign-up, sign-in, password changes and renewal are rate-limited separately. Hammering one doesn't drag the others down.
Password derivation is capped too. Each Argon2id run needs tens of megabytes of memory. Without a cap on how many run at once, a sign-in rush would be a memory-exhaustion attack in itself. So sign-up, sign-in and password changes share a gate of fixed size. Requests wait their turn, give up if they can't, and never take the server down.
Sign-up won't tell you whether an email is already registered. Try to create an account with an existing email and you get the same response as with a new one. The only way to check an account exists, or that a password is right, is to sign in. That way nobody can find out who has an account here.
Four things on your side
- Give LCT a password you use nowhere else. Reused passwords are the most common way accounts get taken, and this part is entirely up to you. Let a password manager generate a random one.
- Turn on two-step verification for your email. Your inbox is the root of every other account you have, and it deserves more protection than any single site.
- Check the domain in the address bar before signing in, especially if you came from a chat app or a search ad. A password typed into a fake page is the same password.
- Anyone asking for your password is running a scam, whether they say they're support, staff or the police. We won't ask and couldn't look it up anyway. There's no plain text to look at.
Why not passkeys?
Passkeys do resist phishing better, because the domain is part of the check and a fake site can't get a usable credential. But they ask much more of devices and account recovery. New phones, lost devices and syncing across several devices each need a whole system around them.
With the platform not yet open, we'd rather make the baseline solid first: no plain-text passwords, a floor on derivation settings, per-action rate limits, and separate clocks for sessions and renewal. That's a trade-off for now, not a final answer.