Is it safe to give a dashboard my Palworld admin password?
Fair question — it's the thing we care most about, since it's literally other admins' server credentials. Here's exactly what happens to your password, with no glossing over the one honest caveat.
What happens when you type it in
Encrypted the moment it arrives
You enter your server's admin/REST password once, over HTTPS. It's encrypted at rest (AES-256-GCM) the instant it reaches our server — the encryption key only exists in a server-side environment variable, never in the database, the code, or your browser.
After that
Never shown again, never logged
It's never displayed back to you, never written to logs, and never sent to your browser again. Every action you take (kick, ban, announce, restart) runs through our server-side proxy — your browser never holds the credential and never talks to your game server directly. Nothing is posted anywhere public: it's one encrypted value only our server can decrypt.
The one honest caveat
Plain HTTP to your server, by default
Palworld's REST API is usually plain HTTP, so on the hop between our server and yours, the password isn't encrypted in transit — that's a Palworld/self-host thing (true of any tool that talks to your server's REST API), not something we can fix from our end. Tamerdeck flags it the moment you're on HTTP and links to a quick fix: harden this server. You'll see this called out on the connect screen itself, too.
One more thing we collect
Anonymous port patterns, to make discovery smarter
When auto-discovery misses and you connect manually, we log which REST port worked for that kind of host (e.g. "Aternos") — nothing that identifies you or your server. No address, no user ID, no server ID, just a host pattern and a port number. It's how we teach auto-discovery to find more hosts over time. Full details in the privacy policy.