You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Previous episode Passkeys: how you log in to a website with no password at all

How passwords and logins work: why a website should not know your password

Session cookies: how a website remembers that you are logged in

You log in once. Then you click around the website for an hour, and it never asks who you are again. Yet every click reaches the website as a brand-new message.

  1. 1 You logged in once. Then you tap Tuesday, 6 pm and Book. Each tap sends the website a new message, a request, and the website answers each one on its own, with no memory of the one before.the gym'sserverTuesday6 pmBookWho are you?

    You logged in once. Then you tap Tuesday, 6 pm and Book. Each tap sends the website a new message, a request, and the website answers each one on its own, with no memory of the one before.

  2. 2 Asking for your password at every tap would drive anyone away. Yet the website must know that this Book comes from you.youPassword,please?Password,please?Password,please?

    Asking for your password at every tap would drive anyone away. Yet the website must know that this Book comes from you.

The rest of this episode is for subscribers

Subscribe to read every premium episode. You can cancel when you want.

Paid yearly: $99 instead of $119.88

Next episode Session hijacking: what a thief can do with a stolen login cookie

Share this comic

More comics