A two-minute, no-installation demo of credential-based two-factor sign-in.
Step 1 looks like an ordinary sign-in form: a username and a password. Step 2 is where it changes — instead of a one-time code from your phone, this page presents a real, cryptographically signed credential this domain issued you, and signs a fresh one-time challenge with the same key the credential names as its owner. Revoke that credential — no password reset involved — and the second factor starts failing immediately, on the very next attempt. Both keys involved are generated right here in your browser and never leave it except as a signature; every request below is a genuine call to this domain's own server, not a mockup.
Swap the demo credential for a real one — a company-issued device pass, a membership card, a staff badge — and this is passwordless-adjacent 2FA where the "device" is provable and individually revocable, without a shared secret (a TOTP seed, a backup code) sitting on either side that could leak. Deactivating one person's access is exactly as targeted as revoking one credential id.
Generates a wallet keypair in this tab and issues it a login credential from this domain — the credential your password step below will need a second factor from.
Nothing on this page is stored in a database anywhere, and reloading it starts a fresh demo account from scratch. Back to the plaza.