The everyday experience
Signing in takes one tap.
From the user's point of view there are three moments, and only one of them requires them to do anything at all. Here is the whole sequence, including the parts they never see.
The complete sign-in, end to end
Three moments. Only one asks anything of them.
Enter your email
No password field. They type the address they were registered with and select Sign in.
Approve on your phone
A push notification arrives on the enrolled device. They review the request and tap Accept.
You are in
The browser completes the sign-in on its own and they land in the application.
Signing in
What happens behind the tap.
The user
They enter their email address
That is the whole form. There is no password field on the sign-in screen, and no password on the account behind it.
IAMShield
An approval request is sent
expires in two minutes
A single-use challenge is generated and delivered as a push notification to the phone that person enrolled.
The user
They tap Accept
The request names what is being authorised. A request they did not start is a signal, not an inconvenience — one tap on Deny stops it.
Their phone
The challenge is signed
The phone signs the challenge with a private key held in its own secure storage and returns only the signature. The key itself is never sent.
IAMShield
The signature is verified
It is checked against the public key registered when the device was enrolled. If it matches, the browser completes the sign-in.
The record
The event is written down
Who signed in, to what, from where and when — available to administrators in the console and to the user in their own session view.
Device enrolment, from email address to working credential
Two proofs, one credential.
The emailed code proves the person controls the mailbox on their account. The QR code carries a one-time challenge that only the phone in front of the screen can answer.
Start registration
They enter their work email address to begin linking a device.
Confirm the code
A six-digit code arrives by email and is entered in the IAMShield app.
Scan the QR code
The app scans the code on screen and generates a key pair on the device.
Device linked
The device is now the credential. Every future sign-in is passwordless.
Getting started
Linking a device takes about a minute.
Each person enrols once. The process proves they control both the email address on their account and the phone in their hand, and it ends with a key pair generated on the device itself.
The user
They install the IAMShield app
Android and iOS
The app is what receives approval requests, holds the key and does the signing. It is supplied as part of the programme.
The user
They confirm their email address
valid three minutes
A six-digit code is sent to the address on their account. Entering it proves they control that mailbox.
The user
They scan a QR code
The code on screen carries a one-time challenge that only the phone in front of it can answer, tying the device to the person at the screen.
Their phone
A key pair is generated
RSA-2048
The device creates a key pair and sends only the public half to IAMShield. The private key stays on the phone for the life of the enrolment.
IAMShield
The device becomes the credential
From that point the phone is how that person proves who they are, and the account has no password to fall back to.
Two proofs, one credential
Everything here is short-lived on purpose.
Security model
Why this is stronger than a password.
The difference is not that the credential is harder to guess. It is that there is no credential to guess, intercept or reuse — only a key that stays on one device and a challenge that is valid once.
- 01No shared secret
The server never holds anything that could be used to impersonate a user. A stolen database contains public keys, which are useless on their own.
- 02Phishing-resistant
There is nothing for the user to type into a fake page. An attacker who controls a lookalike site still cannot produce a valid signature.
- 03Single-use challenges
Every sign-in is a fresh random challenge. A captured signature cannot be replayed against a later attempt.
- 04Out-of-band approval
The approval happens on a different device and a different channel from the browser session being authenticated.
- 05Short-lived by design
Approval requests expire in two minutes, limiting the window for any intercepted value.
- 06Explicit consent
Every sign-in requires a deliberate tap. An unexpected request is a warning the user can act on immediately.
Start with a pilot, not a migration.
IAMShield is available now through an early-access programme. You run it against a small group of real users, with your own applications, before committing to anything wider.
Tell us which application you would put behind it first, and we will have an environment ready for you.