Ask HN: Hetzner asking for passport for new account? just me, or everyone?
Just made a Hetzner account, activated 2FA, the usual.
Then go to buy a storage box, and I get this;
Our automated system check indicates that your account information has an increased level of risk. Please choose one of the following verification methods:
And you can pay 20 EUR up front by PayPal, or hand over your passport (fat chance!)
Is this genuine, or does everyone get this and it's a fake reason?
(I've signed up to pay by bank transfer, so I'm also wondering why they don't ask me for pre-payment by bank transfer. As it is, no way on God's clean earth they get a passport, and I'm not on Paypal, so will try to use a friend's, but seems my second try to board Hetzner train has bounced - first time I left almost immediately, when I saw spaces not permitted in passwords.)
In this technical retrospective (2025), @casenmgreen shares practical architectural lessons learned from running, scaling, or migrating production software under lean constraints.
HN engineers debated the tradeoffs between cloud convenience and raw server economics, database indexing strategies, and resisting premature architectural complexity.
Hetzner has had a bad reputation for quite some time. I am not sure why people are mentioning them nowadays again as a provider they are moving to or setting up new accounts. I have noticed this uptick in mentions of Hetzner on the internet via personal stories in past month or two which makes me believe they invested into some guerilla promotion campaign. If you search the internet and go beyond articles older than one year, you will find all the bad stories related to Hetzner and how they treat their customers.
Personally, I tried to set up account with them in the past, fully being aware of their reputation, because of one service I wanted to use. But after I registered and gave them my payment card details, all fully legit, they blocked the account and I never had a chance to use them. So my own personal opinion is that they can pound sand and experiences of other people should not be ignored and you should definitely not risk putting your data or your business reputation into their hands. There are MUCH better providers in Europe that. Again, I have no idea why people even give Hetzner a chance nowadays.
Hi there, Katie from Hetzner here. We are extra careful about new accounts because we find that it helps us to prevent abuse, and in situations where a new account is somewhere in the grey zone of possibly real or fake, we may ask for additional information, or a PayPal payment, like in this situation. If you choose PayPal, the €20 will go on your account in the form of credit and will automatically be used towards your future invoices. If you decide to cancel your account, and there is credit left on your account, we will refund you for that amount. For the passport (or other documents) -- We have very strict data protection laws here in Germany and the EU. We only use this data to confirm your identity, and after that, it is automatically deleted from our systems after a short time. We have a data protection team who customers can contact if they have any questions at data-protection@hetzner.com. --Katie
You raised some red flags with the information you provided. This doesn't happen to everyone. A support rep from Hetzner has spoke a bit more about this process on WebHostingTalk before[1], although they don't get into which specific heuristics may result in flagged accounts for obvious reasons. I'd imagine it's a combination of things like unpaid balances on previous accounts, IP address reputation, uncommon e-mail domains and so on.
[1] https://www.webhostingtalk.com/showthread.php?t=1810197&p=10239313#post10239313
It happened to me too, and I was unable to verify myself by any acceptable means due to being based in a country other than that of my passport. Having been redirected somewhere else for the identity verification onboarding, I think the process is outsourced by Hetzner to a firm of security specialists apparently oblivious to edge cases. Nice work if you can get it.
There's some other specific character besides spaces that's also not permitted in passwords. It's a normal printable ascii character but I can't remember what it is any more, and sometimes it's not caught. Let's hope nobody signs up with it by mistake.
So what? If you spend any amount of time traveling outside the EU, there are dozens of copies of your passport floating around on hotel scrap paper, random employees personal phones and the like. Not to mention any other services, including those in the EU, that require KYC authentication. Just to add a data point I sent Hetzner my passport in 2009 and nothing bad happened.