Start here: beyond the password

Maya forgot her password again. She uses the same one on many sites. This track shows a safer and easier way to sign in. Your goal: understand how modern sign-in works without a password.

The problem with passwords

A password is a shared secret. You know it, and so does the site. So it is easy to phish, reuse and leak. A passkey removes the secret. MFA adds more proof. Good sign-in does both. It stays quiet when all looks normal. It asks for more proof when the risk is high. SSO lets you sign in once for many apps.

You already see these ideas

• Your phone opens with your fingerprint. Nothing is sent to anyone. A passkey works the same way.
• Your bank app asks for an OTP on a new phone, or before a big transfer. That is more proof, only when the risk is high.
• At work, one login opens mail, chat and the leave portal. That is SSO.

Scammers also phone people and ask them to read out an OTP. Learn to spot that in Spotting phishing and fake logins.

What you will learn

1. Passkeys & WebAuthn — a key that cannot be phished.
2. MFA & factors — a second proof, without lockouts.
3. Account recovery — a way back in that is not a back door.
4. Adaptive MFA — challenge strange sign-ins only.
5. Step-up & assurance — fresh proof before a risky action.
6. Bot detection — slow down bots.
7. Breached passwords — block leaked passwords safely.
8. Enterprise SSO — send each user to their company login.
9. Sessions & sign-out — what happens after login.
10. Native-to-web SSO — move a signed-in session from an app to the web.
11. Magic links & email codes (OTP) — sign in by email, and its risks.
12. Identity verification — prove a real person owns the account.
13. Cheat sheet & pop quiz — the track in short, then a quiz.

How to use it

Take one lesson at a time. Your progress is saved in your browser. New here? Try the Foundations lesson on proving who you are first.

Start with passkeys & WebAuthn.