Passwordless · self-hosted
Remember a few symbols. Every login the grid reshuffles — so the numbers you type change while your symbols stay the same. Easier to remember, harder to shoulder-surf.
The idea in four steps
At sign-up you pick a symbol to remember in each row, and mark some rows to ignore.
On every login the rows and symbols shuffle into new positions.
Find your symbols and type the numbers where they landed this time.
The server maps your input back through the shuffle and checks the hash.
The problem
Complexity rules push people into reusing passwords or writing them on a note.
Anyone watching your screen or keyboard captures the exact same string.
A captured password works again and again until it's changed.
How it works
The thing you memorise never changes. The thing a bystander sees you type changes every single login.
Choose a symbol to remember in each row and mark the rows you'll neglect. Nothing about your choice is stored in readable form.
We derive a single secret from your choices and store only its salted hash — never your symbols, never their positions.
The grid reshuffles, you type the new positions, and the server reverses the shuffle to rebuild the secret and compare hashes.
Why teams try it
Visual memory beats memorising a random string of characters and symbols.
What a bystander sees you type is different — and useless — next time.
No phone, no token, no magic link. Just something you already remember.
Runs on a standard PHP + SQLite stack. Clone, configure, run.
Free to use and modify for individuals and companies alike.
Accounts lock after repeated failed attempts — a core part of the defence.
Security model
We'd rather be precise than loud. Here's what the method helps with, and what stays your responsibility.
For developers
PHP-based, runs on a standard stack with no database server to configure. Clone, start a server, open the demo. Full docs and a security checklist are included.
# clone and run — no credentials, no DB server git clone passnumber-demo cd passnumber-demo php -S 127.0.0.1:8000 -t public # storage: salted hash only (no plaintext) password_hash($token, PASSWORD_DEFAULT); # queries: prepared statements, always $stmt = $pdo->prepare( 'SELECT * FROM users WHERE username = :u' );
Where you can use it
Try it in any browser right now. Native apps and a free WordPress plugin are on the way.
Native apps so you can log in straight from your phone. Coming soon.
A free plugin to replace the conventional password login on your WordPress site. Coming soon.
Want to know when the apps or plugin launch? Drop us a line.
Built in the open
Pick a few symbols, watch the grid reshuffle, and log in — right in your browser.