A secure website login has two separate jobs: HTTPS/TLS protects the connection between your browser and the site, while an authentication method checks that you can access an account. After you pass that check, the site usually creates a session so your browser can make later requests without asking you to log in again.
What happens when you click Log in?
The exact steps depend on the site and the method you choose, but a common login follows this sequence:
As an Amazon Associate I earn from qualifying purchases.
- Your browser connects to the site over HTTPS. HTTPS uses Transport Layer Security (TLS) to protect traffic in transit. During the TLS handshake, the browser and server agree on connection settings and establish keys for protected communication. The browser also checks the server’s certificate and its relationship to the domain you requested. This helps protect the connection and confirm which site the browser reached; it does not prove that you own an account there. MDN’s TLS guide explains the connection and certificate checks.
- You provide proof of account access. With a password login, your browser sends the username and password to the site over that protected connection. The server finds the account record and checks the submitted password against the credential representation it stores. A well-designed site avoids revealing whether an account exists: MDN says, “If the record was not found or the comparison fails, the server must return the same error message in both cases.” See MDN’s password guidance.
- The site verifies the method you used. That may mean checking a password, a one-time code, an identity-provider response, or a public-key challenge, as described below.
- The site establishes a signed-in session. After successful authentication, the site commonly sends a session cookie. Your browser stores it and, under the cookie’s rules, sends it with later requests to that site. The server uses the cookie’s session identifier to associate those requests with your signed-in session. MDN describes this pattern in its guides to authentication and HTTP cookies.
The cookie continues a session; it does not prove your real-world identity. Because it can act as a bearer secret, someone who obtains it may be able to act as that session.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat does HTTPS protect—and what does it not do?
HTTPS/TLS encrypts and protects data moving between your browser and the website, and helps authenticate the website to your browser. It does not check whether the person entering a password is the account owner. That is the authentication method’s job. As MDN puts it, “All websites should serve all pages and subresources over HTTPS, and implement server authentication.” Read MDN’s TLS guide.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A padlock or secure-connection indicator therefore tells you about the browser’s connection to the site, not whether the site is trustworthy in every respect, whether your account is safe from every attack, or whether your credentials are correct. TLS protects traffic in transit; account security also depends on the login method, the site’s implementation, and how the session is handled.
How do common login methods differ?
Websites do not all use the same login sequence. These methods differ in what proves access and what you need to have available:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | What proves access | What you need | Security considerations |
|---|---|---|---|
| Password | A secret you know, checked against the account’s stored credential representation. | The password and the account identifier the site requests. | A password reused across sites can expose other accounts if it is stolen from one of them. The site must handle password checks and error responses safely. |
| One-time code | A temporary code, often used as an additional check or as part of a passwordless flow. | Access to the channel or authenticator that receives or generates the code. | The code adds a separate step, but the exact protection depends on how the site delivers and verifies it. |
| Federated sign-in | A response from an identity provider that the website accepts. | An account with that provider and access to it. | The site relies on the identity provider for that part of the sign-in flow. Recovery and protection depend on the provider and the site’s setup. |
| Passkey (WebAuthn) | A signed response to a site’s challenge, made with a private key associated with that site. | A supported device or authenticator with the passkey, plus support for passkeys on the site. | The private key is not sent to the website. This challenge-and-response approach is designed to resist phishing, but availability and account recovery vary by site and device. |
With a passkey, the site sends a challenge and the authenticator signs it with the private key; the site checks the signed response. A biometric check, if your device uses one to unlock the passkey, is performed by the device and is not itself sent to the website. A physical security key is one possible WebAuthn authenticator, but neither a security key nor a passkey is required for ordinary website login. The site and your device must support the method. MDN explains WebAuthn challenges and hardware authenticators in its WebAuthn guide for web extensions.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How does a website keep you logged in?
Once you are authenticated, your browser can send the session cookie along with later requests that match its rules. The site reads the session identifier and looks up the associated signed-in session, so you do not have to submit the full login form for every page. Cookie settings determine when and where the browser sends it; they are not merely cosmetic.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For session cookies, MDN recommends controls that limit exposure:
Securetells the browser to send the cookie only over HTTPS.HttpOnlyprevents page JavaScript from reading the cookie.- Narrow host or domain and path scope limit where the browser sends it.
SameSitecan limit sending cookies in cross-site requests and reduce some cross-site request forgery (CSRF) risk, but it is not a complete CSRF defense.- The
__Host-cookie prefix can require additional host-only settings in browsers that support it.
These controls help reduce cookie exposure and misuse; they do not make an account immune to attack. The details of secure cookie configuration and session risks are covered in MDN’s cookie guide, its secure cookie configuration guide, and its session-management guide.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
