Log in on one phone below, then ask both phones for your orders.

Log in on one phone, then ask for your orders on both

Phone Ano token

—

Phone Bno token

—

Server remembers 0 sessions
  1. server log — nothing yet

The password is checked once. After that the token is you— whoever holds it, on whatever phone. That's why apps have "log out everywhere", and why a token in the wrong place is as bad as a password.

Only the phone that logged in got your orders. That check, proving it's you, is login, also called authentication.

MDN: "Authentication is in general the process of proving that some fact is genuine." For login, the fact is that you are who you claim to be.

What a login actually checks
  1. You claim an identity

    You type your email: "I'm ana@example.com"

  2. You present a credential

    A password, a one-time code, or a passkey

  3. The app verifies it

    Does this credential match that account?

  4. A session starts

    If it matches, you're logged in from now on

Notice the app never checks the person. It checks something only you should have.

MDN again: authentication "is typically performed by having a user present a user identifier along with a credential, such as a password, a one-time code, or an assertion signed with a private key." The identifier says who; the credential proves it.

Supabase puts it plainly: "Authentication means checking that a user is who they say they are."

The catch hides in that sentence: the app checks the credential, not the human. Anyone holding your password passes the same test, which is why a leaked password logs a stranger in as you, and why a second factor helps.

Try it with the rules off. In the sandbox, log in with the wrong password and watch it refuse. Then ask for orders on a phone that never logged in.

Check yourself

0/3 got it

Saved on this device only. No account, no streaks.

Next in who are you: Passwords and hashing.