In short
LinxyPass signs you in to a website without a password. The site shows you a Linxy Mark or a six-digit code; you scan it or enter it in the Linxy App, your phone asks you to confirm, and the site lets you in. Nothing is typed, nothing is remembered, and there is no password for the site to lose.
The part that puzzles people is that the thing on the screen is not a secret. The Mark identifies the sign-in attempt, not you. Anyone can photograph it; it will do them no good, because what actually proves the sign-in is your enrolled phone answering the question it is sent. Sharing your screen during a sign-in is harmless. Losing your phone is the thing that matters.
On this page
- The idea
- Why the Mark on screen is not a secret
- Four ways to answer
- Why you pick a number instead of pressing yes
- What you are shown before you approve
- How long you have
- How this compares with what you are used to
- Signing in from the App, and what enrolling now gives you
- Symptoms, causes and fixes
- Things people commonly get wrong
The idea
A password is a secret you and a website both know. That is its weakness: the website has to store something, you have to remember something, and either of you can lose it.
LinxyPass removes the shared secret. When you sign in, the site opens a short-lived sign-in attempt and shows you something that points at it. You answer that attempt from a phone you enrolled earlier. The site never holds a password because there is not one to hold.
Why the Mark on screen is not a secret
This is the single most useful thing to understand, and it settles most of the worries people have.
The Mark or code on the sign-in page is a ticket number for an attempt. It says "someone is trying to sign in, here". It does not say who, and it carries nothing about you. Anybody who copies it can do exactly one thing with it: cause your phone to be asked whether you want to sign in — and you would say no.
Four ways to answer
| Way | You do this | Best when |
|---|---|---|
| Scan | Point the App at the Mark on the other screen | Signing in on a laptop or a shared computer |
| Long press | Press and hold the Mark on the same phone | Signing in on the same phone the App is on |
| Code | Type the six digits into the App | The camera will not cooperate, or the Mark will not read |
| Push approval | Answer the prompt that arrives by itself | The site knows who is signing in — you typed your username or email, or the browser remembers you from before |
The long-press route is worth knowing about, because signing in on the same phone that holds the App is the case where scanning is impossible — you cannot point a camera at its own screen. Pressing and holding the Mark achieves the same thing, and the image is checked to make sure it really is a Mark rather than a picture of one.
Why you pick a number instead of pressing yes
When approval arrives on your phone, you are not shown a request with an Approve button. You are shown a two-digit number on the signing-in screen and three numbers on your phone, and you have to choose the matching one.
The reason is a well-known failure of ordinary approval prompts. People who receive a stream of them stop reading and start tapping yes, which is precisely what an attacker relies on: send enough prompts and one will be waved through. Here, waving it through does not work. A prompt you did not cause gives you a two-in-three chance of choosing wrongly, and a wrong choice cancels the sign-in rather than approving it. Your first pick is final — Linxy checks it, not your phone — and three wrong numbers at the same site within 15 minutes pause sign-in there for 15 minutes.
On lnxy.me itself, and on some other sites, you will usually not see a number at all. Each sign-in there is shown its own image, so the scan already says which screen you are looking at; you scan, confirm with your face or fingerprint, and you are in.
So the habit to build is simple: if you did not just try to sign in somewhere, do not guess. There is no safe guess.
What you are shown before you approve
The approval screen tells you what it can about where the request came from: the browser, the operating system, and where in the world it appears to be.
What it will not do is invent any of that. If the location cannot be determined it shows a country instead of a city, and if even that is unavailable it shows nothing at all rather than a guess. An empty row means "not known", never "nowhere" — and because rows are hidden rather than filled with placeholders, everything you are shown can be trusted.
How long you have
A sign-in attempt lasts five minutes. Enrolling for the first time is tighter at three, because that flow involves an email and the shorter window limits how long a link is useful to anybody else.
Five minutes is also the ceiling. A website cannot ask for a longer window than that, so no site you use can weaken this by configuring it generously.
How this compares with what you are used to
| Password | Texted code | LinxyPass | |
|---|---|---|---|
| Something the site stores | Yes | Yes, a phone number | No |
| Works if the site is breached | Reused passwords fall | Number is exposed | Nothing to take |
| Vulnerable to a convincing fake site | Yes | Yes | You are told where the request came from |
| Survives you forgetting things | No | Yes | Yes |
| Approving by reflex is dangerous | — | Yes | No — a wrong guess cancels the sign-in |
Signing in from the App, and what enrolling now gives you
Everything above describes a sign-in the site starts: it shows its Mark, you answer. Once you are enrolled, there is a second direction. The site becomes a Brand card in the App’s Connections, with a Sign in segment on it. Tap that, confirm with your face or fingerprint, and the site opens in your browser signed in — no Mark to find, no number to match, because your phone is the one asking rather than the one answering. That is One-Tap, and the same card can be pinned to your home screen as its own icon. Both are covered in One-Tap sign-in and Pinning a Brand to your home screen.
Enrolling also opens a line to the site’s team. The Brand card is a Connection: you can write to them from it, and they can reply. What they cannot do is write to you first — the channel starts muted, and the first time you open it the App asks whether to let the Brand message you without waiting for you. Say no and nothing arrives unless you write; say yes and they can send updates. Either answer can be changed later, and what the Brand can see of you follows the same disclosure rules as any other Connection. See Enrolling a site for what the enrollment page promises and Brand-to-consumer Connections for how the channel behaves.
Symptoms, causes and fixes
| Symptom | Cause | Fix |
|---|---|---|
| The sign-in screen expired | Five minutes passed | Refresh the page for a new attempt |
| A prompt arrived and I was not signing in | Somebody else has your username or email at a site you use | Deny it. Do not guess |
| I picked a number and the sign-in was canceled | The number did not match; the first pick is final | Choose Start over on the sign-in page and match the new number |
| The camera cannot read the Mark | Glare, angle, or a very small render | Use the six-digit code instead |
| I am on my phone and cannot scan my own screen | Nothing is wrong | Press and hold the Mark instead |
| The approval screen shows no location | It could not be determined | Nothing. A blank row means unknown, not nowhere |
| I want longer than five minutes | Five minutes is the maximum | Start a fresh attempt |
Things people commonly get wrong
Related reading: Signing in with LinxyPass, Enrolling a site, Approving from your watch, and LinxyPass in the App.