Is HourFarming safe? How your Steam account is handled

Updated August 25, 2026 · 18,452 hours farmed on HourFarming so far

Short answer: HourFarming signs your Steam account in the way the Steam client does and leaves games running. It has no code for trading, buying, selling, crafting, commenting or changing your login. With QR sign-in it never sees your password; with a password sign-in the password is encrypted and never leaves the farm server. Idling is not a VAC offence, but nobody can promise Valve will never change its mind — this page says what we do, what we cannot protect you from, and when you should not use us at all.

Does HourFarming ever see my Steam password?

With QR sign-in, no. You scan a code with the Steam Mobile app, approve the login on Valve’s side, and HourFarming receives a Steam-issued session token — the same kind the Steam client keeps so you don’t retype your password every day. That token is what gets stored, encrypted, and you can cut it off at any time from Steam Guard’s “deauthorize all devices”. If you choose a password sign-in instead, the password is encrypted with AES-256-GCM before it is written to disk, using a key that exists only on the farm server (a file readable by the service alone). It is decrypted only for the moment a worker needs to log in. HourFarming will never ask you to disable Steam Guard, share a backup code, or move Steam Guard to our phone: when Steam asks for a code, the panel asks you, and you type it.

Where does my login actually live?

HourFarming runs on two separate systems on purpose. Your HourFarming sign-in (email, password hash, subscription state) lives with our sign-in provider, Supabase. Everything about your Steam accounts — the encrypted credential, the session token, game lists, settings, logs, hours — lives on the farm server, which verifies your identity with the provider’s public signing key and never sends Steam data back the other way. The farm server holds one privileged key for the provider, used only to record payments and erase accounts, and never the provider’s all-access key. If the sign-in provider were breached, the attacker would have HourFarming email addresses and password hashes, not Steam credentials. If the farm server were breached, they would need its encryption key as well as the database. Neither system ever transmits a Steam password in plain text, including to us.

What does HourFarming do inside my account — and what does it never do?

The worker that farms your account sends Steam two kinds of instruction: “log in” and “these games are being played.” Everything in the left column below is something you can see happen; everything in the right column has no code path in the product, so it cannot be turned on by a setting, a bug in the panel, or a stranger who got hold of your HourFarming password. Rep Farm, the comment exchange, only reads public profile pages to verify a comment exists. Level Boost is a planner: it works out the cheapest badge path and links you to Market listings — every purchase and every craft is a click you make yourself in your own Steam client, or not at all.

Can I get banned for using it?

VAC looks for cheat software inside a running game process on your PC; HourFarming runs no game and touches no game files, it reports playtime through the same protocol the Steam client uses. There is no documented case of a VAC ban for idling, and Valve’s Subscriber Agreement does not name idling — but it does let Valve act against accounts at its discretion, and rules can change. So the honest statement is: the risk is low, it is not zero, and anyone who promises zero is selling something. The safety guide goes through what VAC actually detects, what the agreement says, and where this niche’s real problems have been.

What can go wrong?

Things that happen, in the order you are likely to meet them. Steam Guard prompts: Steam sometimes asks for a fresh code after a long session or a network change; the panel shows the prompt and farming waits for you. Session conflicts: when you play on your own PC the farming session pauses; the other device may briefly say “logged in elsewhere” and HourFarming waits at least five minutes before reconnecting. Limited accounts (under $5 spent) idle five games at once by default — a cautious setting you can raise. The refund window: Steam refunds games with under two hours played; farmed hours count, so idle a game you might return and you have given up the refund. Free plan limits: 100 farmed hours a month, the persona forced Online, and the game title shown to your friends is “Farming on HourFarming.com” — that is our advertising, and it is visible. Expired tokens: a QR session token eventually expires and you scan again. Valve: can change the rules; we are not Valve and cannot promise otherwise.

When should you not use HourFarming?

• You might refund a game you would be farming — farmed hours forfeit the refund.
• Your account holds a high-value inventory or runs as a trading business and you are not comfortable letting any third party hold a session for it, even one with no trading code. That caution is reasonable.
• You play ranked CS2 and care about Trust Factor: idled hours are not banned hours, but see the Trust Factor guide before deciding.
• You need hours on games you do not own. HourFarming can claim free games for you; it cannot add paid ones.
• You expect idled hours to look like played hours. They look like idled hours: long, flat, 24/7 sessions. Anyone checking closely can tell, and HourFarming does not try to hide it.

How do I delete everything?

Deleting a Steam account from the panel removes its credentials, session token and logs immediately; its statistics (Steam login, profile id, hours per game) are kept so the account restores if you add it again. Cancelling a subscription stops billing and downgrades the plan — it deletes nothing. To erase your whole HourFarming presence, email [email protected] from your sign-in address: erasure is done by hand, cancels any subscription, deletes every record on the farm server and the sign-in provider, and keeps one line — the erased account’s internal id and which subscription was cancelled — so a late payment notification cannot recreate anything. The privacy policy lists every category of data we hold.

What protects the service itself?

• HTTPS everywhere with HSTS; a strict Content Security Policy; clickjacking and referrer protections.
• Your HourFarming login can use two-factor authentication (an authenticator app), turned on in Account.
• Every request to the panel carries a signed token verified against the sign-in provider’s public key; a request with someone else’s token cannot see or touch your accounts.
• Rate limits on every public tool, search and the comment exchange; sign-in attempts are limited by the sign-in provider.
• Logs shown in the panel are scrubbed of file paths and stack traces, and a worker process’s crash output is never attached to another user’s log.
• Payments are handled by the payment processors (Paddle, PayPal, NOWPayments); card numbers never touch HourFarming.

Found a security problem?

Email [email protected] with the details. You will get a reply from a person, a fix if the report is right, and credit here if you want it. There is no bounty programme; we would rather say so than promise one we cannot fund.

Questions people ask before signing in