Security & How it works
Designed for the absence of passwords
Access Glow doesn't make passwords harder to steal — it removes them from the equation entirely. Here's how it works and why that matters.
How visual authentication works
When a user visits a WordPress site protected by Access Glow, the login page displays an encoded visual token instead of a username and password form. This token is generated fresh for every login attempt, is cryptographically unique, and expires within seconds.
The user opens the Access Glow app on their phone, which is already enrolled with that site. The app retrieves the pending encoded token and renders the matching visual representation. The user confirms the match using biometrics — fingerprint or face authentication — and the login is approved.
No credentials are typed. No shared secret travels over the network. The server validates the match using a time-bound, cryptographically unique token tied to that specific login session.
1
Session opensThe WordPress plugin requests a login session from the Access Glow server. A unique visual code is generated and displayed on the login page.
2
User confirms on phoneThe user opens the Access Glow app. The app retrieves the pending encoded token and renders the matching visual. The user authenticates with their fingerprint or face — biometric confirmation is required to approve the login.
3
Server validates and logs inThe server validates the approval — checking the session token, the device, and the time window. If everything matches, the WordPress login is completed.
Why it's strongly phishing-resistant
Traditional phishing works by tricking a user into entering their credentials on a fake page. Those credentials are then used on the real site. Access Glow makes this attack largely ineffective:
- There are no credentials to enter. A phishing page that mimics your WordPress login page would show a visual code — but that code is tied to the attacker's session, not the victim's. The victim's app approval would log the attacker in, but the attacker would need to be watching in real time (a relay attack), which is far harder to execute than credential theft.
- Codes expire in seconds. Each visual code is valid for a short window. There is no window in which stolen session data can be replayed after the fact.
- Biometrics are the second factor — always.Even if an attacker has physical access to the enrolled device, they cannot approve a login without passing the device's biometric check (fingerprint or face). The encoded token and the biometric confirmation must both succeed.
Access Glow replaces passwords with a security model built around cryptographically secure tokens, computer vision, and biometric verification. WordPress passwords are never stored or transmitted by Access Glow, removing one of the most common targets for attackers. Although no authentication system can guarantee absolute security, Access Glow is engineered to provide strong protection against credential theft, phishing, password reuse, and credential stuffing through a fundamentally different authentication architecture. We believe trust is earned through sound engineering and transparent security claims — not marketing promises.
What lives on our servers
- Your account. Name and email address, used to identify your account and send transactional emails (password reset, welcome message).
- Site records. The WordPress sites you've registered — their name, URL, and a site token used to identify login sessions.
- Device tokens. A per-device, per-site token stored on the user's phone and matched server-side during login. This is not a password — it cannot be used to derive one.
- Login session data. Short-lived records of pending login sessions. These expire within seconds and are not retained as a permanent log.
We do not store passwords — because there are none. We do not store biometric data. We do not track users across sites or share data with third parties for advertising purposes.
Transport and infrastructure security
- All communication between the WordPress plugin, the mobile app, and the Access Glow API is encrypted over TLS (HTTPS).
- API keys and site secrets are stored hashed — the server never holds the plaintext value.
- The mobile app stores device tokens in the Android Keystore / iOS Secure Enclave — protected by hardware-level security and released only after a successful biometric check.
- Login sessions have a strict expiry enforced server-side.
- The API returns no stack traces or debug information in production.
Responsible disclosure
If you believe you have found a security vulnerability in Access Glow, please report it to us at [email protected] before disclosing it publicly. We take all reports seriously and will respond promptly.