Humble Bundle's new redesign inexplicably removes 2-factor authentication, dramatically weakening account security

Humble Bundle, the storefront long beloved by PC gamers for its charity-driven bundles and DRM-free game deals, has launched a sweeping redesign of its website. But according to reports, the new look comes with a troubling omission: two-factor authentication appears to have vanished from account settings. For a platform that stores payment details and a sizable library of game keys, that is no small oversight.

The advice from PC Gamer is blunt: remove your saved payment details, at least for now. Below, we break down what is known, why it matters, and what you can do to protect yourself while the situation develops.

What Changed in the Humble Bundle Redesign

Humble Bundle rolled out a refreshed interface intended to modernize how users browse bundles, the store, and their personal libraries. Redesigns are common, and most come with a few rough edges that get smoothed out in the following weeks.

This one, however, appears to have quietly stripped out an important security feature. Users who previously relied on two-factor authentication (2FA) to guard their accounts reportedly can no longer find the option in their settings.

There was no prominent announcement explaining the change. Players discovered it on their own, which only adds to the confusion about whether the removal is intentional or a bug.

Why Losing Two-Factor Authentication Matters

Two-factor authentication adds a second hurdle for anyone trying to break into your account. Even if an attacker has your password, they still need a code from your phone or an authenticator app to get in.

Without it, your account is only as safe as your password. Given how frequently credentials leak in data breaches and how many people reuse passwords across sites, that is a serious downgrade.

Humble accounts are also attractive targets. They hold game keys for Steam and other platforms, which can be redeemed or resold, and they may be tied to saved payment methods.

The Risk to Your Saved Payment Details

This is why the recommendation to remove saved payment information carries weight. If someone gains access to your account, stored cards or linked payment services could be used to make unauthorized purchases.

Removing those details limits the potential damage. You may need to re-enter your card at checkout, but that minor inconvenience is small compared to dealing with fraudulent charges.

It is a precautionary step, not a guarantee of safety, but it meaningfully reduces your exposure while 2FA remains unavailable.

Is This a Bug or a Deliberate Decision?

The most puzzling part is the lack of explanation. Removing 2FA runs against nearly every modern security practice, so many observers suspect an oversight during the migration to the new design.

If it is a bug, the fix could come quickly, and the feature may return soon. If it is intentional, the company will face tough questions about why it chose to reduce protection for its users.

Either way, clear communication is the minimum users should expect. Silence leaves customers guessing about the safety of their accounts.

Steps You Can Take to Protect Your Account

First, remove any saved credit cards, debit cards, or other payment methods from your Humble Bundle account. Check your payment settings carefully to confirm they are gone.

Second, change your password to something long, unique, and not used anywhere else. A password manager makes this easy and helps you avoid reuse across services.

Third, review your account for suspicious activity, such as unfamiliar orders or key redemptions. If anything looks off, contact Humble Bundle support right away and consider notifying your bank.

Securing the Services Linked to Humble

Your Humble account often connects to other platforms, including Steam, and those accounts deserve attention too. Make sure 2FA is active on every linked service that still supports it.

Also consider the email address tied to your Humble account. If that inbox is compromised, attackers could reset your password, so enabling 2FA on your email is one of the best defenses you can set up.

What the Community Is Saying

Reaction among gamers has been a mix of frustration and disbelief. Many long-time customers praise Humble for its charitable mission and fair pricing but say that security should never be sacrificed for aesthetics.

Others are calling for the company to restore 2FA immediately and to publish a clear statement. Social media threads are filling with users sharing screenshots and urging others to lock down their accounts.

What to Watch for Next

The key thing to monitor is whether Humble Bundle responds publicly. An official statement confirming a bug, a timeline for a fix, or an explanation of a deliberate change would go a long way toward restoring trust.

Until two-factor authentication returns, treat your account with extra caution. Keep payment details off the site, use a strong unique password, and stay alert for any updates from the company.

A redesign should make a service better, not leave users more vulnerable. Hopefully Humble Bundle will correct course quickly, and until then, a few minutes of precaution can save you a lot of trouble.

If you have any questions, please don't hesitate to Contact Us