Sign In With a Passkey, No Code Needed

You can now sign in to rifts.to with a passkey. It uses the unlock you already have on your phone or laptop: Face ID, Touch ID, Windows Hello, or a password manager like 1Password. There's nothing to type and no email to wait for.

Passkeys are free, like the account itself.

Why passkeys

A rifts.to account has always started with a six-digit code sent to your email. It works, but it pulls you out of the page at the worst moment: just after you've built a survey, with a room waiting to answer it. You switch to your inbox, the email takes a minute, now and then it lands in spam, and the poll sits there unstarted.

With a passkey, your device confirms it's you and you're signed in.

Where to use one

Right after you create a survey, the box that offers to save your admin link now has a Create a passkey button. Type your email, press it, confirm on your device, and the survey is saved to your new account.

On the sign-in page, choose Continue with a passkey. Already have an account but no passkey yet? Sign in with the emailed code as before, then add one from your account page.

Confirm your email, even if you only use passkeys

A passkey lives on your device or in your password manager. If you lose it, the only way back into your account is a code sent to your email, so an account you only ever sign in to with a passkey still needs a confirmed address. Your account page calls it your recovery email until you confirm it, and confirming takes one code.

We only send notices, like a heads-up before a survey stops taking answers, to an address that has been confirmed.

Confirm it straight away

If you create an account with a passkey, skip confirming the email, and later sign in with an emailed code instead, the passkeys added before the address was confirmed are removed. Your account page tells you when that happens, and any passkey you add afterwards stays.

This stops someone who types your email address into rifts.to from keeping a way into an account that belongs to you. Confirming from your own account page while you're signed in removes nothing, so the easy habit is to confirm your recovery email right after you create the passkey.

Managing your passkeys

The Passkeys section of your account page lists each one by where it's saved, such as 1Password or iCloud Keychain, with when it was added and last used. Remove the ones you no longer use, or add another for a second device.

If adding one tells you a passkey is already saved there, that device or password manager already holds one for your account. Add the next one somewhere else, or use a security key.

We keep the public half of each passkey and never the private half, which stays with you. The privacy policy lists what we store.

The code isn't going away

Signing in with an emailed code works as it did. Use it on a shared computer, on a device without passkeys, or whenever it's simpler. And you still don't need an account at all to create a survey and run a poll.