Identity & authentication
Who is allowed in
Every system we build starts with one question: who should be able to enter at all? We establish strong boundaries around identity before anything else exists.
Strong password foundations
Passwords are stored using slow, salted, memory-hard hashing — never reversible. Breached-password checks block known-weak credentials at the door, and users are pushed toward passphrases, not guesses.
Multi-factor authentication
A password alone is never the final gate. One-time codes, TOTP authenticator apps, passkeys, biometrics and backup codes combine so a stolen password is not enough to get in.
Email & phone verification
Accounts verify the contact information that owns them before sensitive actions unlock. Verification links and codes are one-shot, time-limited and rate-limited against brute force.
Recovery that cannot be hijacked
Password reset and account recovery use out-of-band verification, rotating tokens and forced re-verification of the device — so recovery paths do not become takeover paths.
Sessions as temporary trust
Sessions are short-lived credentials, not permanent entitlements. Tokens expire, rotate and are re-verified for sensitive actions, keeping a long-lived session from outliving its need.
Kill switches per session
Any session can be terminated individually or everywhere at once from the account. Losing a device or forgetting a laptop never means permanent access.


