Why this is written in general terms
You will not find a walkthrough of one company's buttons here. Interfaces are redrawn every few months, screenshots go stale, and a course written around one vendor's layout teaches you that layout rather than the task. What follows applies to any online game of this kind: the order of operations, the decisions attached to each one, and the things that are easier to do before the account exists than after.
Set aside half an hour. Do it with the player present if the player is a child — the account conversation is one of the more useful ones available to a household, and it only happens once.
The email address
The address attached to an account is the route back in when something goes wrong. It is also the address that will receive the game's messages, and anything the vendor sends about billing.
If you decided in step two to create a dedicated address, create it now and confirm you can read mail at it. Use an address that belongs to the person who should be able to recover the account. In a household with a young player, that is normally an adult; the player can still know the game password.
Avoid using a work email address for a personal game account. Access to a work mailbox ends when the job does, and the account goes with it.
The passphrase
A passphrase is several unrelated words used together instead of a short complicated password. The Australian Cyber Security Centre recommends passphrases and explains how to build one in its public guidance at cyber.gov.au; the short version is that length and unpredictability do more work than punctuation tricks.
Three rules make the difference here:
- Unique to this account. The common way game accounts are lost is not clever attacks on the game; it is a password reused from a different site that was itself breached.
- Written down somewhere real. A password manager is ideal. Paper in a drawer is acceptable and much better than a phrase that nobody can remember and everyone therefore simplifies.
- Decided before the form asks. Passphrases invented under time pressure inside a sign-up form are the weak ones.
Two-factor authentication
Two-factor authentication means that knowing the passphrase is not enough on its own: a second thing is needed, usually a code from an app on a phone, or sometimes a code by email. Where a vendor offers it, turning it on is the single biggest improvement you can make to an account's safety, and the ACSC's guidance on multi-factor authentication explains the options in general terms.
If it is offered, enable it during setup rather than later, and store any recovery codes the vendor gives you alongside the passphrase. If it is not offered, note that fact; it tells you something about how the vendor treats account security, and it makes the uniqueness of the passphrase matter more.
The account procedure, nine steps
- Decide the email address. Use the one you chose in step two. Create it first if it does not exist yet, and confirm you can receive mail at it.
- Write the passphrase before you need it. Four or more unrelated words, used nowhere else, recorded on paper or in a password manager.
- Open the vendor's own sign-up page. Type the address or use a link you trust, rather than following a search advertisement that happens to appear at the top of a results page.
- Fill in only the required fields. Required fields are usually marked. Leave the optional ones blank until you know why they are wanted; a date of birth, where it is required, is normally used to apply age-based settings.
- Read the consent boxes before ticking them. Accepting the terms of service is normally necessary to have an account at all. Agreeing to marketing email is a separate box and is not.
- Confirm the address from the verification email. Open the message in the mailbox itself. If a verification link arrives by any other route, ignore it.
- Turn on two-factor authentication if it is offered, and store the recovery codes with the passphrase.
- Set the privacy and chat options before anyone plays. Work through the account's privacy, chat and friend-request settings and match them to the position your household agreed in step two. Do this before the first session, not after.
- Decide about payment details last. Add a card only if a purchase is actually being made now, and decide deliberately whether it is stored for future use.
Payment details
Whether to store a payment method is a household decision, not a technical one. A stored card removes the pause between wanting something and buying it, which is convenient for an adult and significant for a child.
Three arrangements households use, in rough order of how much friction they add:
| Arrangement | What it means in practice |
|---|---|
| No stored payment method | Every purchase requires an adult and a card. Most friction, fewest surprises. |
| A prepaid or gift balance where the vendor supports one | Spending is capped by the balance. Useful for giving a child real control inside a real limit. |
| A stored card | Convenient for the account holder; needs the device itself to be locked and the account password not shared. |
Whichever you choose, write the choice next to your step-two sentence so that step five has something to review against.
Controls that sit outside the game
Two layers of control exist beyond the game's own settings, and they are often the more durable ones because they survive a game update.
The device. Operating systems on computers, phones and tablets include family or screen-time settings that can limit hours, restrict purchases or require approval for installations. Where these exist, the operating system's own help pages describe them accurately for the version you have.
The store or platform. If the game was obtained through an app store or a game platform, that platform usually has its own purchase controls, separate from both the device and the game. A purchase password on the platform is a common and effective arrangement.
The eSafety Commissioner publishes general advice for families on setting up devices and games, and on the conversations worth having alongside the settings. Settings alone are a weaker control than settings plus an agreement that everyone understands.
If the account you are making is the one we are paid to link to
The nine steps above apply unchanged. We have no description of Star Stable Online's sign-up screens, options or settings, so we are not going to pretend to lead you through them; the vendor's own help pages describe its own interface, and they are current in a way that a third-party page cannot be.
Paid link: creating an account after following it pays us a commission, at no additional cost to you, and the advice on this page is the same either way.
The first session
The first half hour is worth treating as part of the setup rather than as play. Five things to do, ideally with the player.
- Find the settings menu together and confirm that the chat and friend options are where you left them. Some games apply defaults on first entry that differ from what was set on the website.
- Find the block and report buttons and use them once on nothing in particular, so that everyone has seen where they are.
- Find the shop, if there is one, and look at it without buying. Agreeing what happens there is easier before anything is wanted.
- Agree how a session ends. Online games are built around activities that take a while; knowing in advance what counts as a stopping point prevents the argument at the end.
- Check how long the session actually lasted against the pattern agreed in step two, and adjust the pattern if the reality is clearly different.
Nothing here is urgent and nothing on this page suggests your household is at risk. These are the same ordinary arrangements you would make for any new activity: where things are, who to tell, when to stop.
The worked household at step four
Our hypothetical household made the new email address first and sent a test message to it. The adult chose a four-word passphrase, wrote it in a notebook kept in a kitchen drawer, and read it to the child, who could remember it by the second attempt.
They created the account on the vendor's own site with the child watching, left the marketing box unticked, and verified the address from the mailbox. Two-factor authentication was available, so it was turned on and the recovery codes went into the same notebook. The privacy settings were worked through before the first session and matched the friends-only position from step two.
No payment method was stored. The first session ran for forty minutes rather than the half hour they had imagined, which told them more about the game's rhythm than any description had, and became the reason step five exists.
Before you move on
- The recovery email address decides who can get the account back.
- A unique passphrase, written down somewhere real, prevents the most common way accounts are lost.
- Turn on two-factor authentication at setup if the vendor offers it.
- Privacy and chat settings are set before the first session, not after it.
- Device and platform controls outlive any individual game's settings.
- Storing a payment method is a household decision with real consequences in step five.
Checklist for step four
- The account email address exists, is not a work address, and I can read mail at it.
- The passphrase is unique to this account and is written down where it can be found again.
- I created the account from the vendor's own site, not from an advertisement.
- I read the consent boxes and left marketing consent unticked unless I wanted it.
- Two-factor authentication is on, or I have noted that the vendor does not offer it.
- Recovery codes, if any, are stored with the passphrase.
- Privacy, chat and friend-request settings match our step-two position.
- I have decided whether a payment method is stored, and written the decision down.
- Device and platform controls have been looked at, using their own help pages.
- In the first session we found the settings, the block and report buttons, and the shop.
- We agreed what counts as the end of a session.