Skip to main content
What the integrator sets up, and what the user does and how long it takes at the first and at a repeat sign-in. The times of the other methods come from published reports and our own measurements; the Veriqa times are all our own measurements. The setup answers and the effort levels are our assessment, and the rules behind them are below the tables.

​
Sign-in: user effort and time

Effort is a level from 1 to 5 on the scale below. A number in square brackets points to the source of the time. Times of up to 15 seconds are in bold. With Veriqa the first sign-in takes as long as a repeat one, so the table shows a single time.

​
Setup: what the integrator does

What the setup includes:
  • Password — password storage and hashing, a sign-up form, email confirmation, password reset, an email provider, a second factor, brute-force protection, support for users who forget their password.
  • SMS code — a contract with an SMS provider, sender registration with the carriers, code generation and verification, rate limits and protection against SMS fraud, a charge for every message.
  • Social login — for each provider: a developer account (paid, in Apple’s case), an application, a consent screen, redirect URIs, keys, the provider’s review of the application, and your own code that handles the response and links accounts.
  • Passkey — a WebAuthn server library, the relying party ID and origin settings, a table for the users’ public keys, sign-up and sign-in code on the server and on the front end. The integrator creates no secrets. A fallback sign-in is needed for a lost or new device — usually a link by email, and that takes an email provider.
  • Veriqa — run the container, point it at a database, create a bot and set its token, issue two token certificates, declare an OIDC client, put the service behind a reverse proxy and connect your application as you would to any OIDC provider. Step by step in Quickstart self-hosted.

​
Sources for the sign-in times

  1. Microsoft Learn — Passkeys (FIDO2) authentication method in Microsoft Entra ID. Signing in with a synced passkey takes 3 seconds, versus 69 seconds for a password with a traditional second factor. Data on Microsoft consumer accounts.
  2. FIDO Alliance — Passkey Index, October 2025. A passkey sign-in takes 8.5 seconds on average. Data reported by nine member companies of the alliance.
  3. Google Security Blog — Making authentication faster than ever: passkeys vs. passwords. A sign-in takes 14.9 seconds on average with a passkey and 30.4 seconds with a password. Data on about 100 million sign-ins to Google accounts, March–April 2023.
  4. Google for Developers — Mercari’s passkey authentication speeds up sign-in 3.9 times. A sign-in with an SMS code takes 17 seconds on average. Mercari’s data on its own users.
  5. Our own measurement, taken in Telegram on a phone where the messenger was already installed and signed in. For a sign-in on a computer, the user opens the camera, points it at the QR code and taps the link; with confirmation they also tap Confirm. In other messengers the time may differ.
  6. Our own measurement of sign-in with Google on the Logto sign-in page. The first sign-in took 30 seconds in a browser already signed in to Google: Google still asked for the second factor. A repeat sign-in took 3.4 seconds and one click. In a browser not signed in to Google, the first sign-in also requires typing the account password.
  7. Our own measurement of a passkey kept on the phone, on the same Logto sign-in page. Creating the key took 24 seconds after some practice and about a minute the very first time; creating the account is not counted. A repeat sign-in on a computer took 18 seconds.
Where the sources give no time for the first sign-in, the table shows only the repeat one. The figures were collected in different ways: a survey of companies, the statistics of one vendor and our own measurement. Read them as an order of magnitude, not as one experiment.

​
How user effort is counted

We count what the user does in a clean browser, with no password manager: every click, tap, scan and typed field. Scanning a QR code with the phone camera is one action. The actions in each scenario:

​
How the setup is assessed

Three questions for each method: can an AI agent do the whole setup, how much of a person’s time it takes, and whether a third party has to be involved. The answers are our assessment; only the Veriqa time was measured. How Veriqa differs from passkeys, messenger sign-in widgets, SMS codes and the device flow in substance rather than in figures is covered in How Veriqa differs.