Why we never ask for your MT5 password

A password gives too much away

Your MT5 master password lets whoever holds it trade your account, from anywhere, at any time. Even the investor password, which is read-only, lets anyone see every trade and balance, and you cannot tell who is using it.

Many services that show MT5 results ask for one of these passwords, and many scams start the same way. Once a password has left your hands, you cannot know where it went, and the only fix is to change it everywhere.

So Quantrivance does not ask. Nothing in it has a field for your MT5 password.

A token instead

The Agent, a small EA you attach to a chart in your own terminal, reads the account from inside MT5 and reports it to us with a token:

• You create it in the app, for one MT5 account. It is a long random code, shown to you once.
• It works for that account only. A token copied into another account's terminal is refused.
• We keep only a fingerprint of it. The token is stored in a form that cannot be turned back into the code, so even we cannot read it back.
• You can revoke it at any moment. Create a new token on the MT5 accounts page and the old one stops working at once.

If a token leaks, the worst anyone can do with it is send reports for that one account, until you replace it. It cannot trade, and it cannot sign in to Quantrivance.

What the Agent reads

The Agent reads what the terminal already shows you: the account's balance and equity, its open positions and its deal history. When you turn control on, it also lists the charts that have an EA on them, so you can bind them to strategies. It reports once a minute to one address, https://api.quantrivance.com, over an encrypted connection.

It does not read your other files, your other terminals, or anything outside MT5.

What the Agent can do

It never opens a trade. There is no code in the Agent that opens a position or places an order, and we check its source for that with an automated test every time it changes.

It can close, but only if you allow it. The Agent's input "Let the web app stop trading here" (AllowControl) is off by default, and only you can turn it on, in your terminal. We cannot switch it on from our side. With it on, the Agent will close charts, delete pending orders and close positions when you send a kill command with your 2FA code, or when a Guard limit you set is reached.

With it off, the Agent is a reporter and nothing more.

If someone asks for your password

We will never ask for your MT5 password: not by email, not on Telegram, not in a Facebook group, and not to "verify" an account. If anyone asks for it in our name, do not give it, and tell us at admin@quantrivance.com.

The same rule is worth keeping everywhere. A service that needs your master password to show you results is asking for more than it needs.

This post is for education and is not investment advice. Examples use made-up figures, not anyone’s results. Trading carries risk.