The Hytale Bastion Cape Is the Only Cape We Can Find That Costs Nothing, and You Get It by Turning On 2FA: A Complete Account Security Guide

There is one cape in Hytale you do not buy. You earn the Bastion Cape by turning on two-factor authentication, and that is the whole requirement. As far as we can find, it is the only cape in the game that costs nothing. Every other cape we are aware of is a purchase. This one is a reward for securing your account, and it arrives automatically. Here is the official line, in full, from Hytale's own pre-release patch notes, under the "Avatar & Customization" subheading of the "Pre-Release (Update 6 Part 8)" section, dated July 22, 2026 on the page: Added a new unlockable cosmetic: the Bastion Cape! This new cape can only be wielded by security-conscious Avatars that have enabled two-factor authentication for their Hytale account. That sentence is almost the entire official documentation of this cosmetic. There is no store page, because it is not sold, and the community wiki page for it is empty. This guide covers the cape first, including the one condition that is not actually confirmed, then the security material it rewards, taken from Hytale's published support articles, because turning on 2FA without understanding backup codes is how people lock themselves out. What the Developer Post Said About the Cape The cape was announced on 24 June 2026 by DevSlashNull (Eli), @DevSlashNulled, whose X bio reads "Working to bring you @Hytale" and lists "Former: NOC @HypixelNetwork, Executive Director @MCProHosting". That is how we are describing him, from his own bio, because we have not confirmed a job title at Hypixel Studios. The relevant passage, verbatim: We're also adding a brand new cape as a thank you for keeping your account secure. Anyone with authenticator app 2FA enabled will get it automatically when it launches, and if you're already enrolled there's nothing you need to do. And for anyone who had not set 2FA up yet: Want it but haven't set up 2FA yet? Enable it on the accounts page, and the cape will be ready for you to wear the moment it drops. Two things come out of that. There is no claim step: no code to redeem, no ticket, no form. If the account qualifies, the cape is granted. And enrolling early was explicitly fine, since people already on 2FA had nothing to do. The One Thing Nobody Has Confirmed: Do Passkeys Count? This is the most useful paragraph in the article, so we are giving it its own section. The official patch notes say the cape requires "two-factor authentication", with no method named. The developer post says "authenticator app 2FA", naming one specific method. And Hytale's own support knowledge base confirms the account offers two 2FA methods, not one: mobile authentication and passkeys. Those three statements do not resolve into an answer. Whether an account secured with a passkey and no authenticator app qualifies for the Bastion Cape is not confirmed by any source we can find. The patch notes wording would suggest yes. The announcement wording would suggest no. Nobody has written down which one governs, and we are not going to guess on your behalf. The practical advice, which is ours: if you want the cape, enable authenticator app 2FA, because that is the method the announcement names explicitly. If you prefer passkeys for everyday sign-in, there is nothing stopping you having both, and the support team's own description of backup codes treats them as covering either method. Hytale's Two 2FA Methods, in the Support Team's Words Hytale's support article on troubleshooting 2FA sign-in issues, last updated 17 August 2026, is the clearest official description of what the account actually supports: If signing in requires more than your password and an email verification code, that means Two-Factor Authentication (2FA) is enabled on your Hytale account. Hytale offers a couple of 2FA options: mobile authentication and passkeys. On the first method: Mobile authentication requires a time-sensitive code in addition to your usual login. These 6-digit codes are generated by an authenticator app on your device, such as Google Authenticator or Microsoft Authenticator, and refresh on a rolling interval. On the second: A passkey is a secure, password-free way to sign in. Instead of typing anything in, your identity is confirmed using your device's built-in security, such as Face ID, Touch ID, Windows Hello, or a physical security key. Note what that first quote also tells you: an email verification code on its own is not 2FA in Hytale's terminology. If signing in only ever asks you for your password and a code emailed to you, you do not have 2FA enabled, which also means you would not qualify for the cape. There Is No Official Walkthrough for Turning 2FA On We want to be straight about a gap. Hytale's support knowledge base does not contain a step-by-step guide to enabling 2FA. What it has is a troubleshooting article for 2FA that is already switched on, and the developer post's instruction to "Enable it on the accounts page". The settings page the official material points to is accounts.hytale.com/settings, which we confirmed returns HTTP 200 today. We are not going to walk you through a click sequence on a screen we have not documented, because invented steps age badly and send people hunting for buttons that may be labelled something else. Go to the settings page, find the security options, and enable mobile authentication with an authenticator app. Then do the next section, which is the part people skip. Backup Codes: Do This Before You Need It This is the single highest-value thing in the whole support knowledge base, and it is worth quoting at length: When you enable 2FA, you're given a set of backup codes that act as a safety net for both mobile authentication and passkeys. If you lose access to your authenticator app or passkey device, you can enter an unused code to sign in. Each code works only once, so store them somewhere safe and accessible. Three details inside that paragraph matter. The codes cover both methods, so they are your fallback whether you use an authenticator app or a passkey. Each code is single use. And "safe and accessible" is doing real work: a backup code locked inside a password manager you can only unlock with the phone you just lost is not a backup. If you already enabled 2FA at some point and have no idea where the codes went, the support article tells you what to search for: The file is usually named hytale-backup-codes, so try searching for that. Search hytale-backup-codes across your downloads folder, your cloud drive and your email attachments. The security article is blunter about the consequence of not having them: Always keep a copy of the backup codes you received when you set up Two-Factor Authentication in case you ever lose your phone. You will be locked out of your accounts if you lose your phone and these codes. When a 2FA Code Will Not Let You In: The Official Order The troubleshooting article gives a sequence, and it is a sensible one because it puts the recoverable causes before the destructive options. In the order the knowledge base gives it: Reinstall the authenticator app. Cloud backup may restore your entries, so a reinstall alone sometimes fixes it. Work out which app you used. On Android: Play Store, then the profile icon, then Manage apps & device, then Manage, then filter by "Not installed". On iPhone: App Store, then your profile picture, then Apps, then My Apps. Check your password managers. The knowledge base names 1Password, Keeper and Bitwarden. Plenty of people stored a TOTP seed in one of those years ago and forgot. Check the device date and time. Time-based codes fail when the clock drifts. The article gives per-operating-system steps for Android, iPhone, Windows and Mac. Disable any VPN or proxy. Try a different browser, or an incognito window. Then sign in with a backup code. This is where the codes you saved earlier earn their place. The clock check is the one most people would never think of and the one that explains the largest share of "the code is correct but it says it is wrong" reports. Fix the clock before you start considering recovery. The Account Security Rules Hytale Actually Publishes Hytale's security article, updated 1 July 2026, sets the tone in one line: Players bear full responsibility for all actions performed on their account. Which leads directly into its first rule: First and foremost no account sharing. The only person who should have access is yourself and no one else. On passwords, the guidance is at least 12 characters, mixed character types, and a unique password per account. It also makes a point that a lot of password advice leaves out: substituting numbers for letters is not enough on its own, and it uses its own example, P4aS5W0rd!, to show what it means. A predictable substitution of a common word is still a predictable word. On scams, three lines worth memorising: One of the most common scams is to send you an invite to an unofficial Discord server and ask for verification with your email and verification code. Do not enter your 2-factor authentication outside of the official Hytale website! Do not claim or buy tokens or versions of Hytale, it is probably a scam. Third-party websites are not authorised to sell Hytale versions or usernames without our consent, and any account purchased through it may be blocked. And the line that covers most remaining cases: Please remember that our team will never ask for your information! The Discord verification scam is the one to watch for in a launch window, because that is exactly when people join unfamiliar servers for a game they are excited about. A verification bot that wants your email and a verification code is not verification, it is a credential capture. Is This Link Real? The Official Domains and Socials The security article lists the official domains and social accounts, which makes it a usable reference for checking whether a link somebody sent you is genuine. The list it gives: https://hytale.com https://store.hytale.com https://www.youtube.com/@Hytale https://x.com/Hytale https://bsky.app/profile/hytale.bsky.social https://www.instagram.com/hytalegame https://www.tiktok.com/@hytale Alongside those, the account subdomain carries the pages you will actually use: accounts.hytale.com/settings for 2FA, accounts.hytale.com/redeem for gift codes and accounts.hytale.com/recovery for recovery. All three returned HTTP 200 when we checked today. Security disclosures go through hytale.com/security, which runs on Bugcrowd, and which is the background to our piece on the PNG remote code execution flaw and the bug bounty payout. That disclosure came out of the same Update 6 Part 8 pre-release that added the Bastion Cape. Anything that is not on that list, asking for anything on your account, should be treated as hostile until proven otherwise. If You Think You Have Been Compromised The security article gives an order of operations, and the order is the point. Its steps: change the email account password, change the associated account password, attempt to recover the account, contact the support of the service, then add extra security such as 2FA. Email first is correct and often done last. If the attacker still controls the inbox, every password reset you perform is a reset they can intercept. Lock the mailbox, then the game account, then recover, then harden. The recovery article adds two concrete compromise indicators that are easy to check: Check your inbox for an email change notification. If your account email was changed, you should have received a confirmation from Hytale with the subject line "Your Hytale Account Email Address Was Changed." Check whether a previous purchase is missing. If you're able to log in but notice that a purchase you made is no longer showing on your account, you may have unknowingly created a new account. That second one is worth reading twice, because it is the counterintuitive case. A missing purchase often is not theft. It is usually you, signed in to a second account you did not know you had created. Account Recovery, and the Two Traps That Create Duplicate Accounts Start with the hard limit, stated plainly by the support team: If you have lost access to your Hytale account email, or can no longer remember it, your account cannot be recovered using these methods. That is why the email account is the real root of trust, and why it deserves its own 2FA independent of Hytale's. Next, sign-in methods are not interchangeable by default: Hytale supports several sign-in options, including Discord, Email & Password, and Google. If you haven't linked any additional methods in your account settings, you'll only be able to log in using the method you originally signed up with. Our reading: link a second method now, while you can still get in. A single sign-in route is a single point of failure, and the moment to add redundancy is never the moment you need it. Then the trap that generates the most confused support requests. If you try to create an account and get this error, you already have one: An account with the same identifier (email, phone, username, ...) exists already. And the Gmail-specific version of the same problem, which is genuinely subtle: Gmail's dot-stripping behavior. Google ignores dots (.) in the address, so [email protected] and [email protected] both deliver to the same inbox. However, Hytale treats these as two separate email addresses. So both spellings reach the same mailbox, but Hytale sees two distinct accounts. If a purchase has vanished, or an account you are certain exists cannot be found, try the address with and without its dots before assuming something worse has happened. The Launcher Sign-In Loop If the website signs you in but the launcher will not, the support team's fix is a specific order rather than a setting. Sign out at accounts.hytale.com, sign out inside the launcher, log in on the website first and leave that tab open, then click Sign In in the launcher. The website session being live and open is the part that matters, and doing these steps out of order is why the loop persists. One clarification, because the words overlap and the problems do not. This is account authentication, your Hytale account signing in to Hytale's own services. It is a different thing from server authentication, which is what happens when a Hytale server validates a connecting player. If your problem is a server refusing logins or dropping sessions, that is covered in our server authentication guide on auth, login and persistence errors, and in our fixes for failed to connect errors. Nothing in this article will fix a server-side auth failure. Gifting a Copy of Hytale The same developer post that announced the cape announced gifting: Gifting launches this week. You'll be able to buy Hytale for your friends, it's one of your most requested feature for the site and it's almost here. That phrasing, "most requested feature" singular, is as posted, and we have left it as written. The support article on gifting, updated 30 September 2026 and the most recently updated article in the entire knowledge base, explains what a gift actually is: Want to share Hytale with a friend? You can purchase any Early Access edition as a gift. Instead of a game profile on your own account, you receive a gift code that your friend redeems on their own Hytale account to create their game profile. So a gift purchase does not create anything on your account. It creates a code. Two conditions attached to that, both quoted: Players in locations offering regional pricing: All gift purchases are not subject to regional pricing and will be processed at the global price. Please note: Gifts are non-refundable as outlined in our refund policy. Make sure to only share the gift code with the intended recipient, and hold onto your transaction ID in case you need to reach out to support about your purchase. We quote no prices, because we have not verified live figures. In practice the regional pricing note means a gift is charged at the global price wherever you are, so it will not carry the discount a purchase for yourself might. Buying a Gift The mechanics, as documented: go to store.hytale.com and click GIFT next to PURCHASE. A "Gift Purchase Notice" appears. Confirm it is showing the right account, and if it is not, use the "Switch here" link. Click I UNDERSTAND, then pay. The gift code is emailed to you. Check the account on that notice screen. A gift bought from the wrong signed-in account is a non-refundable purchase, which is exactly the situation the transaction ID advice exists for. Redeeming a Gift Your friend goes to accounts.hytale.com/redeem and enters the 16-character gift code, formatted as ABCD-1234-EF56-7890. Click Check Gift, then Redeem Gift Code. A new game profile is created on their account. The Check Gift step before Redeem Gift Code is useful: it gives you a chance to confirm the code is valid and that you are redeeming on the intended account before anything is consumed. If the recipient does not have a Hytale account yet, our guide to name reservation and account creation covers that end of it, and if you are gifting so that you can play together, how to play Hytale with friends is the follow-up. One More Thing From That Post: Sign In With Hytale Finally, Sign in with Hytale is on the way. Soon other apps, services, and platforms will be able to offer your Hytale account as a login option, so the same account you already use can work in more places. We are including it because it changes the stakes of everything above. An account that is only a game account is worth securing. An account that becomes a login provider for other services is worth securing considerably more, because a compromise then reaches further than the game. The post says this is "on the way" and does not give a date, and we are not going to supply one. What We Are Not Telling You The things this guide deliberately does not claim, so you know where the edges are. Whether a passkey-only account gets the cape. Unconfirmed. The patch notes say "two-factor authentication", the announcement says "authenticator app 2FA", and nobody has reconciled the two. That it is definitively the only free cape. It is the only cape we can find that costs nothing, which is an absence of evidence rather than confirmed exclusivity. Click-by-click steps to enable 2FA. There is no official walkthrough, and we are not writing one for a screen we have not documented. Prices, and anything from the community wiki. We verified no live prices, and the wiki page for the cape has no content, so neither is used here. Frequently Asked Questions How do you get the Bastion Cape in Hytale? Enable two-factor authentication on your Hytale account. The official patch notes say the cape "can only be wielded by security-conscious Avatars that have enabled two-factor authentication for their Hytale account", and the developer announcement said anyone with authenticator app 2FA enabled gets it automatically, with nothing to do if you are already enrolled. Do passkeys count for the Bastion Cape? Unconfirmed, and this is the honest answer. The patch notes say "two-factor authentication" without naming a method, the developer post says "authenticator app 2FA", and Hytale's support team confirms the account supports both mobile authentication and passkeys. No source we can find says which qualifies. If you want the cape, enable authenticator app 2FA, because that is the method the announcement names. When was the Bastion Cape added to Hytale? It appears in the "Pre-Release (Update 6 Part 8)" section of Hytale's pre-release patch notes, under "Avatar & Customization". The date printed under that heading on the page is July 22, 2026. It was announced in advance on 24 June 2026. What 2FA options does Hytale support? Two, in the support team's words: "Hytale offers a couple of 2FA options: mobile authentication and passkeys." Mobile authentication uses rolling 6-digit codes from an authenticator app such as Google Authenticator or Microsoft Authenticator. A passkey confirms your identity with your device's built-in security, such as Face ID, Touch ID, Windows Hello, or a physical security key. Where are my Hytale backup codes? You were given a set when you enabled 2FA, and they work for both mobile authentication and passkeys. Each one works only once. If you cannot find them, the support article says the file is usually named hytale-backup-codes, so search for that across your downloads, cloud storage and email. My Hytale 2FA code is not working. What do I do? Work through the official order: reinstall the authenticator app in case cloud backup restores it, identify which app you used, check your password managers (1Password, Keeper, Bitwarden), check your device date and time, disable any VPN or proxy, try a different browser or an incognito window, then sign in with a backup code. The clock check resolves more cases than people expect. Can I recover a Hytale account if I lost my email? No. The support article is explicit: "If you have lost access to your Hytale account email, or can no longer remember it, your account cannot be recovered using these methods." Why does Hytale say an account with my email already exists? Because one does. The exact error is "An account with the same identifier (email, phone, username, ...) exists already." If you use Gmail, also try the address with and without dots: Google ignores dots so both forms reach the same inbox, but Hytale treats them as two separate email addresses. How do I gift a copy of Hytale? At store.hytale.com, click GIFT next to PURCHASE, confirm the correct account on the Gift Purchase Notice (use "Switch here" if it is wrong), click I UNDERSTAND and pay. A gift code is emailed to you. Your friend redeems it at accounts.hytale.com/redeem by entering the 16-character code formatted as ABCD-1234-EF56-7890, clicking Check Gift and then Redeem Gift Code, which creates a game profile on their account. Are Hytale gifts refundable or regionally priced? Neither. The support article states that gifts are non-refundable as outlined in the refund policy, and that all gift purchases are not subject to regional pricing and will be processed at the global price. Keep your transaction ID. The Bottom Line The Bastion Cape is the best trade in Hytale cosmetics: a cape, at no cost, for doing the thing you should have done anyway. Added in the Update 6 Part 8 pre-release dated July 22, 2026, granted automatically, no claim step, no store page. Enable authenticator app 2FA at accounts.hytale.com/settings, save the backup codes somewhere you can reach without the phone they protect, and the cape handles itself. Enable the authenticator app specifically, not just a passkey, because the patch notes and the announcement use different words and nobody has confirmed whether a passkey-only account counts. That is the one real unknown in this guide and we would rather flag it than paper over it. The rest of the account work is dull and worth doing before Chapter 1 arrives on 12 October, because launch week is when scam Discord invites multiply and when a locked account costs you most. Link a second sign-in method while you still can, never enter a 2FA code anywhere but the official Hytale site, and remember that the support team will never ask for your information. Where to go next: our complete guide to emotes and avatar customization for the rest of the cosmetic system, the beginner's guide if the account is new, and the Chapter 1 server preparation checklist if you run a server rather than just play on one.