Logging in to km77 on your device

When you sign in on your phone or computer, we verify your username (or email) and password through our encrypted server. Your login credentials travel through TLS encryption—the same technology banks use to protect their websites. We do not store your password in plain text; we store only a secure hash that cannot be reversed. Once we verify your credentials, we create a session token that identifies you without exposing your password.

Our Android app stores your session token locally on your device in a secure encrypted container. When you close the app, the session ends. If you enable "Remember me" on our website, we store a secure cookie that expires after 30 days of inactivity. On iOS, the mobile browser does not store persistent cookies by default—you may need to log in again on each visit, which adds security for shared devices.

Password reset and account recovery

If you forget your km77 password, click the "Forgot password?" link on this login page. We will ask for your username and email. We send a password-reset link to your registered email address—the link expires after one hour for security. Click the link, and you can set a new password. We do not reset your password directly; only you can set a new one via the secure link.

If you cannot access your email, contact our support team through the account recovery form. We will ask you to verify your identity using the phone number and personal details you provided during registration. This verification process typically takes one to two business days. We take account recovery seriously because your account contains your payment information and account balance.

Two-factor authentication on km77

We recommend enabling two-factor authentication (2FA) in your account settings. When you enable 2FA, every login requires both your password and a one-time code from an authenticator app (Google Authenticator, Microsoft Authenticator, or Authy). This prevents unauthorized access even if someone learns your password.

When you first enable 2FA, we give you a backup recovery code. Store this code somewhere safe—in a password manager or written on paper in a secure place. If you lose access to your authenticator app, the recovery code lets you disable 2FA and regain access to your account. Without a recovery code, you may not be able to log in until our support team assists you.

Logging out and session timeout

Always log out after using km77, especially on shared computers or public devices. Click the logout button in your account menu—this immediately invalidates your session token. On our website, your session also expires automatically if you are inactive for subject to verification. On our Android app, closing the app ends your session; the app does not keep you logged in indefinitely.

If you notice suspicious login activity in your account history—logins from unfamiliar locations or devices, for example—change your password immediately and contact our support team. We monitor for unusual access patterns and may ask you to verify your identity if we detect suspicious activity on your account.