You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Previous episode Phishing: how a fake login page gets past two-factor authentication

How passwords and logins work: why a website should not know your password

Passkeys: how you log in to a website with no password at all

With a passkey, you log in with your face or your PIN, and you use no password at all. A fake login page gets nothing from a passkey. A stolen list from the website opens nothing either.

  1. 1 The gym's website now offers a passkey. You tap "Create a passkey", your phone asks for your face or your PIN, and that is all. You make up no password.youclimbwall.exampleCreate apasskeyFace or PIN

    The gym's website now offers a passkey. You tap "Create a passkey", your phone asks for your face or your PIN, and that is all. You make up no password.

  2. 2 Next week, you log in with one tap and a look at your phone. You type nothing, so there is nothing for anyone to catch you typing.climbwall.exampleWelcomeback!nothing typedyou

    Next week, you log in with one tap and a look at your phone. You type nothing, so there is nothing for anyone to catch you typing.

The rest of this episode is for subscribers

Subscribe to read every premium episode. You can cancel when you want.

Paid yearly: $99 instead of $119.88

Next episode Session cookies: how a website remembers that you are logged in

Share this comic

More comics