Three ways to sign in, side by side
Try each one. The difference is not in the button — it is in what the server ends up holding, and in what your device has to hand over.
Passkey
No shared secret
One tap, then your device's own prompt (Touch ID, Windows Hello, your phone's PIN). The private key never leaves the device; the server stores a public key. Signing in afterwards needs nothing typed at all.
Username + password
A shared secret
The familiar flow, with its bill attached: a secret two parties both know, a reset path, and a list of hashes worth stealing. Compare what the server stores here with the passkey.
Email code
Something you receive
A six-digit code, five minutes, one use, five attempts. Delivery is the weak link — if the inbox is compromised, the code is too.
What each flow leaves on the server
- Passkey — a public key, a credential id, a sign counter. Nothing that can be replayed, and nothing that reveals a secret.
- Password — a salted scrypt hash. Safer than plaintext, still a shared secret to phish, reuse, and reset.
- Email code — nothing persistent, but the code travels through a mailbox and can be read by whoever holds it.