Every website and app I build ships hardened by default. These are working versions of the pieces: try to break them. Two-factor codes below are the real algorithm your Google Authenticator uses; passkeys use your phone or Touch ID; the vault is real AES-256 encryption.
Password: demo1234. Get it wrong 5 times and the account locks for 30 seconds with a countdown — real sites also alert the owner and slow the attacker down exponentially.
Entropy-based meter, common-password and pattern checks, no silly “must contain a symbol” rules — the way modern guidelines (NIST) recommend.
Scan the QR with Google Authenticator, Authy or 1Password — the 6-digit code they show will match the one below, because this is the genuine RFC 6238 algorithm (HMAC-SHA1) computed in your browser.
WebAuthn: register a passkey with Touch ID, Face ID, Windows Hello or your phone, then sign in with it. Phishing-resistant — there is no password to steal. Works on this HTTPS page; the key never leaves your device.
Notes are encrypted in your browser with a key derived from your passphrase (PBKDF2, 200 000 rounds). The server would only ever see the ciphertext below. Change one character of the passphrase and decryption fails.
Paste something nasty — a script tag, an onerror attribute, a fake login form. It is rendered as harmless text, never executed. Content-Security-Policy on this page blocks inline injection as a second wall.
See every device logged into the account, with location and last activity. Revoke any of them instantly — or all others after a password change.
Every site I deploy gets a hardened header set. Enter any domain to see what a scan checks for (this demo shows the checklist rather than fetching the site).
No CAPTCHA puzzles for humans. Forms carry an invisible honeypot field, a timing check (bots submit in milliseconds) and a signed token. Submit this normally and it passes; a bot filling every field would be rejected.
Customers can download everything you hold about them and request deletion — one click, logged, with a cooling-off period before the data is purged.
Every security event on this page is recorded here — on a real site the owner gets an e-mail or push for the important ones (new device, failed logins, exports, deletions).
alwaysheadersauthAPIdataopswatchproduct