A Togu account is created on the website in three stages: a form, a confirmation email, then signing in. This article describes these steps as the site’s pages currently present them, and what to do when the link you received no longer works or when you have forgotten your password. Nothing here says the game world is open: for that, check the Status page.
What to prepare
Before you start, gather four things:
- An invitation code. Request one in the Togu Discord; you need it to create an account.
- An email address you actually check. The form states that you will receive a confirmation link at this address. Reset links also arrive by email at this address: without access to the inbox, you will not be able to open them.
- A username. The form asks for 3 to 20 characters: unaccented letters, digits, hyphen or underscore. A four-digit number is appended to it.
- A password of at least 15 characters. No composition rules are imposed (no requirement for an uppercase letter or a digit). However, the form specifies that passwords that have already appeared in data breaches are rejected. A long passphrase unique to this account works well. A password manager saves you from having to remember it; for general good habits, see our guide securing a game account.
Create a separate Togu account
Open the Create an account page, fill in the address, username, password and invitation code, then tick the box accepting the terms of use. The form links to Togu’s terms of use; read them before ticking the box.
This account belongs to Togu alone. It does not reuse your Ankama account or its password. That is the subject of the last section of this article.
Once the form is submitted, the page announces that an email has been sent to the address you entered and invites you to open the link it contains. If nothing arrives, check your spam folder first before requesting a new one.
Verify your address
The link in the email opens the Confirm email address page. Click “Confirm my address”: the page then states that the address is confirmed, that the account is active and that you can sign in.
If the link does not work, the same page offers to send you a new link when you enter the account’s address. The confirmation link is single-use and valid for 24 hours; when you request a new one, the previous one is no longer valid. The site responds the same way whether or not the address matches a pending account: the message only says that, if a pending account exists, a new link has just been sent.
An expired, already used or unknown link produces the same error message: “This link is not valid or can no longer be used. Request a new one.”
Forgotten password or expired link
From the sign-in page, the “Forgot password?” link leads to the Forgot password page. Enter the account’s address. In every case, the site responds that, if an account exists for this address, a reset email has just been sent. This identical response prevents anyone from guessing which addresses have an account: the OWASP cheat sheet on password recovery calls for returning a consistent message whether or not the account exists.
The reset link is valid for 30 minutes and can only be used once; the same cheat sheet recommends single-use tokens that expire after an appropriate period. On the page that opens, enter your new password, which follows the same rules as at sign-up. Once the password is saved, all your sessions are closed and you must sign in again with the new password: the site does not sign you in automatically, which OWASP also advises against.
If the link has expired, has already been used or is incomplete, simply request a new one from the same page.
Never hand over your Ankama credentials
The sign-up form reminds you: this account belongs to Togu alone, and you must never use an Ankama username or password. The Download page says so too: Togu will never ask for your Ankama password. Any request of this kind, even one presented as coming from Togu, is a warning sign.
For Togu, also use a password you do not use anywhere else. Togu is a private server with no connection to Ankama. Ankama’s support describes, for its own games, the behaviors that should be reported to it; its list (updated March 4, 2026) notably mentions the promotion of fraudulent sites: phishing, private servers, unauthorized trading. These rules are Ankama’s for its own service and say nothing about how a Togu account works.
To find out what data is processed when you sign up, see the Privacy page.
