Posts (Latest 10 updated) :
Read all



The account table

This table holds information on all available accounts.


Field Type Attributes Key Null Default Extra Comment
id int(10) unsigned PRI NO auto_increment Identifier
username varchar(32) UNI NO
sha_pass_hash varchar(40) NO
sessionkey varchar(80) NO
v varchar(64) NO
s varchar(64) NO
token_key varchar(100) NO
email varchar(255) NO
reg_mail varchar(255) NO
joindate timestamp NO CURRENT_TIMESTAMP
last_ip varchar(15) NO
last_attempt_ip varchar(15) NO
failed_logins int(10) unsigned NO 0
locked tinyint(3) unsigned NO 0
lock_country varchar(2) NO 0
last_login timestamp YES NULL
online int(10) unsigned NO 0
expansion tinyint(3) unsigned NO 2
mutetime bigint(20) signed NO 0
mutereason varchar(255) NO
muteby varchar(50) NO
locale tinyint(3) unsigned NO 0
os varchar(3) NO
recruiter int(10) unsigned NO 0
totaltime int(10) unsigned NO 0

Description of the fields


The unique account ID.


The user's account name.

NOTE: usernames are limited to 20 characters and have no character restriction.


This field contains the encrypted password. The encryption is SHA1 and is in the following format: username:password. The SQL to create the password (or to compare with the current hash) is:

Language Code
SQL UPPER(SHA1(CONCAT(UPPER('myusername'), ':', UPPER('mypass'))));
PHP strtoupper(sha1(strtoupper($username).':'.strtoupper($password)));

NOTE: Passwords are limited to 16 characters and have no character restriction.





v and s fields are used by server authentication system since the client uses a SRP6 protocol to handle authentication

If you change the password these fields must be set to 0 allowing the server to regenerate them at login. The .account password command already does it, but you must take care about it on external registration systems (web client)


The authenticator key.

Key can be generated through the Google Authenticator API, a 3rd-party TOTP generator, or manually specified (must be a Base32-compliant expression that is 16 characters).

Implementation link on Wikipedia for the Google Authenticator API


The e-mail address associated with this account.


The registration e-mail address associated with this account.


The date when the account was created.


The last IP used by the person who logged in the account.


The number of failed logins attempted on the account.


Boolean 0 or 1 controlling if the account has been locked or not. This can be controlled with the ".account lock" GM command. If locked (1), the user can only log in with their last_ip. If unlocked (0), a user can log in from any IP, and their last_ip will be updated if it is different. ".Ban account" does not lock it.


The date when the account was last logged into.


Total time played on all the characters of a player. Even the deleted characters that are no longer in the database. Stored in Unix Time.


Boolean 0 or 1 controlling if the account is currently logged in and online.


Integer 0, 1 or 2 controlling if the client logged in on the account has any expansions. (for example if client is TBC, but expansion is set to 0, it will not be able to enter outlands and etc.)

Value Expansion
0 Classic
1 The Burning Crusade (TBC)
2 Wrath of the Lich King (WotLK)
3 Cataclysm
4 Mist of Pandaria (MOP)
5 Warlords of Draenor (WOD)
6 Legion


The time, in Unix time, when the account will be unmuted. To see when mute will be expired you can use this query:



The reason for the mute.


The character name with the rights to the .mute command that give the mute.


The locale used by the client logged into this account. If multiple locale data has been configured and added to the world servers, the world servers will return the proper locale strings to the client. See localization IDs


Stores information about client's OS. Used by Warden system.

  • Win
  • Mac


The account ID of another account. Used for recuit-a-friend system. See