> ## Documentation Index > Fetch the complete documentation index at: https://veriqa.app/docs/llms.txt > Use this file to discover all available pages before exploring further. # Sign-in methods compared > How a password, an SMS code, social login, a passkey and Veriqa compare: what the integrator sets up, what the user does at sign-in and how long it takes — with the source of every figure. What the integrator sets up, and what the user does and how long it takes at the first and at a repeat sign-in. The times of the other methods come from published reports and our own measurements; the Veriqa times are all our own measurements. The setup answers and the effort levels are our assessment, and the rules behind them are below the tables. ## Sign-in: user effort and time Effort is a level from 1 to 5 on the [scale below](#how-user-effort-is-counted). A number in square brackets points to the [source](#sources-for-the-sign-in-times) of the time. | Sign-in method | Scenario | First sign-in | Repeat sign-in | Time: first / repeat | | - | - | - | - | - | | Password | Password only | 5 | 4 | no data / \~30 s [\[3\]](#sources-for-the-sign-in-times) | | Password | With a second factor | 5 | 5 | no data / \~69 s [\[1\]](#sources-for-the-sign-in-times) | | SMS code | — | 4 | 4 | no data / \~17 s [\[4\]](#sources-for-the-sign-in-times) | | Social login | — | 3 | 1 | 30 s / **3.4 s** [\[6\]](#sources-for-the-sign-in-times) | | Passkey | The key is on the same device | 5 | 1 | no data / **3–15 s** [\[1, 2, 3\]](#sources-for-the-sign-in-times) | | Passkey | The key is on the phone, the sign-in is on a computer | 5 | 3 | 24 s / 18 s [\[7\]](#sources-for-the-sign-in-times) | | **Veriqa** | On a computer, automatic sign-in | 1 | 1 | **3.5 s** [\[5\]](#sources-for-the-sign-in-times) | | **Veriqa** | On a computer, with confirmation | 2 | 2 | **6 s** [\[5\]](#sources-for-the-sign-in-times) | | **Veriqa** | On a phone, automatic sign-in | 1 | 1 | **2.4 s** [\[5\]](#sources-for-the-sign-in-times) | | **Veriqa** | On a phone, with confirmation | 1 | 1 | **4 s** [\[5\]](#sources-for-the-sign-in-times) | Times of up to 15 seconds are in bold. With Veriqa the first sign-in takes as long as a repeat one, so the table shows a single time. ## Setup: what the integrator does | Sign-in method | Can an AI agent do the setup? | How much of a person's time does it take? | Is a third party involved? | | - | - | - | - | | Password | The agent writes the code; a person sets up the email provider and DNS | Hours | An email provider, no approval | | SMS code | The agent writes the code; a person signs the contract and registers the sender | Hours of work and days of waiting | An SMS provider and the carriers, with approval | | Social login | The agent writes the code; a person opens the developer accounts and creates the applications | Hours for each provider, plus waiting for the review | Each provider, with a review of the application | | Passkey | The agent writes the code; a person sets up the email provider for the fallback sign-in | Minutes for the passkeys, hours with the fallback sign-in | Not needed for the passkeys; an email provider for the fallback | | **Veriqa** | **The agent does everything except creating the bot** | **15–30 minutes** | The messenger: a Telegram bot is created right away, with no approval | What the setup includes: * **Password** — password storage and hashing, a sign-up form, email confirmation, password reset, an email provider, a second factor, brute-force protection, support for users who forget their password. * **SMS code** — a contract with an SMS provider, sender registration with the carriers, code generation and verification, rate limits and protection against SMS fraud, a charge for every message. * **Social login** — for each provider: a developer account (paid, in Apple's case), an application, a consent screen, redirect URIs, keys, the provider's review of the application, and your own code that handles the response and links accounts. * **Passkey** — a WebAuthn server library, the relying party ID and origin settings, a table for the users' public keys, sign-up and sign-in code on the server and on the front end. The integrator creates no secrets. A fallback sign-in is needed for a lost or new device — usually a link by email, and that takes an email provider. * **Veriqa** — run the container, point it at a database, create a bot and set its token, issue two token certificates, declare an OIDC client, put the service behind a reverse proxy and connect your application as you would to any OIDC provider. Step by step in [Quickstart self-hosted](/docs/quickstart/self-hosted). ## Sources for the sign-in times 1. [Microsoft Learn — Passkeys (FIDO2) authentication method in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2). Signing in with a synced passkey takes 3 seconds, versus 69 seconds for a password with a traditional second factor. Data on Microsoft consumer accounts. 2. [FIDO Alliance — Passkey Index, October 2025](https://fidoalliance.org/fido-alliance-launches-passkey-index-revealing-significant-passkey-uptake-and-business-benefits/). A passkey sign-in takes 8.5 seconds on average. Data reported by nine member companies of the alliance. 3. [Google Security Blog — Making authentication faster than ever: passkeys vs. passwords](https://security.googleblog.com/2023/05/making-authentication-faster-than-ever.html). A sign-in takes 14.9 seconds on average with a passkey and 30.4 seconds with a password. Data on about 100 million sign-ins to Google accounts, March–April 2023. 4. [Google for Developers — Mercari's passkey authentication speeds up sign-in 3.9 times](https://developers.google.com/identity/passkeys/case-studies/mercari). A sign-in with an SMS code takes 17 seconds on average. Mercari's data on its own users. 5. Our own measurement, taken in Telegram on a phone where the messenger was already installed and signed in. For a sign-in on a computer, the user opens the camera, points it at the QR code and taps the link; with confirmation they also tap Confirm. In other messengers the time may differ. 6. Our own measurement of sign-in with Google on the Logto sign-in page. The first sign-in took 30 seconds in a browser already signed in to Google: Google still asked for the second factor. A repeat sign-in took 3.4 seconds and one click. In a browser not signed in to Google, the first sign-in also requires typing the account password. 7. Our own measurement of a passkey kept on the phone, on the same Logto sign-in page. Creating the key took 24 seconds after some practice and about a minute the very first time; creating the account is not counted. A repeat sign-in on a computer took 18 seconds. Where the sources give no time for the first sign-in, the table shows only the repeat one. The figures were collected in different ways: a survey of companies, the statistics of one vendor and our own measurement. Read them as an order of magnitude, not as one experiment. ## How user effort is counted We count what the user does in a clean browser, with no password manager: every click, tap, scan and typed field. Scanning a QR code with the phone camera is one action. | Level | What the user does | | - | - | | 1 | One or two actions, nothing to type | | 2 | Three actions, nothing to type | | 3 | Four or more actions, or one field to type | | 4 | Two fields to type | | 5 | Three or more fields to type | The actions in each scenario: | Method and scenario | First sign-in | Repeat sign-in | | - | - | - | | Password only | Type the email and the password twice, then open the mailbox and click the confirmation link. | Type the username and password. | | Password with a second factor | Type the email and the password twice, then open the mailbox and click the confirmation link. | Type the username and password, then open another app and type the second-factor code. | | SMS code | Type the phone number, wait for the SMS, type the code. | Type the phone number, wait for the SMS, type the code. | | Social login | Click the button, complete the social network's second-factor check and accept the consent screen. In a browser not signed in to the social network, the user also types its username and password. | Click the button. | | Passkey, the key is on the same device | Create an account another way, usually with a password or a code, then create the key and confirm with biometrics. | Click the button and confirm with a fingerprint or a face scan. | | Passkey, the key is on the phone, the sign-in is on a computer | Create an account another way, usually with a password or a code, then create the key and confirm with biometrics. | Click the button, choose another device, scan the QR code with the phone and confirm with biometrics on it. Bluetooth has to be on. | | Veriqa on a computer, automatic sign-in | Scan the QR code with the phone camera and tap the link. | The same. | | Veriqa on a computer, with confirmation | Scan the QR code with the phone camera, tap the link and tap Confirm. | The same. | | Veriqa on a phone, automatic sign-in | Tap the messenger button on the sign-in page. | The same. | | Veriqa on a phone, with confirmation | Tap the messenger button on the sign-in page and tap Confirm. | The same. | ## How the setup is assessed Three questions for each method: can an AI agent do the whole setup, how much of a person's time it takes, and whether a third party has to be involved. The answers are our assessment; only the Veriqa time was measured. How Veriqa differs from passkeys, messenger sign-in widgets, SMS codes and the device flow in substance rather than in figures is covered in [How Veriqa differs](/docs/concepts/comparison). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.