Every password, fingerprint scan and text-message code is trying to answer one question: are you really you? Ten minutes from now you'll understand how that's decided, from a child's diary lock all the way up to the codes that launch nuclear missiles.
Tap a level to jump. Or just scroll and it climbs on its own.
Security is just a way of asking one thing before you're allowed in: "Are you really you?"
Imagine a diary with a little lock. Only the person with the key can read it. The lock doesn't know your name. It just checks: do you have the key, yes or no?
The whole world runs on that one idea. Your phone, your front door, your bank: each one is a lock asking for proof before it opens.
Because we can't see inside anyone's head. A stranger might smile and say "I'm your friend", but you can't be sure it's true.
Every person carries their own secret wants. That's not evil. It's just human. Security exists because a nice smile is not proof.
Some people are clever with words. They can trick you into opening the door for them by pretending to be a teacher, a parent, or a helper. So instead of trusting the smile, we ask for proof.
So we ask for proof instead. There are two honest kinds: something you carry, and something you know.
Hold the right key and you're in. No token, no entry. A car key starts the car; a house key opens your door. Nothing to remember, just use it.
Say the answer only you know and you're in. A bank PIN, a padlock code. Nothing to carry, but the secret lives in your head.
Anyone can smile. A lock wants a token or a secret, something far harder to fake.
Some people act nice just to be let in. A token or a secret stops the act.
Every lock on Earth, from your phone to a bank vault, checks one of three things. Adults call them the three factors. They're really just three kinds of proof.
A password, a PIN, the answer to a secret question. It lives in your head, invisible, but easy to guess or steal if it's weak.
Your phone, a bank card, a key fob, a code sent by text. A thief would need to physically take the object from you.
Your fingerprint, face or voice. It's part of your body, so it can't be forgotten or handed over, but it can never be changed either.
Weak on its own. Strong together. That's the secret: stack the factors.
One factor is a single lock. Add a second and a thief now needs to beat two different things at once: know your password and steal your phone. That's why banks text you a code: it's Factor 2 backing up Factor 1.
Flip the switches to add each kind of proof. Watch the security meter climb, and read what a burglar would have to do to get past you.
Watch the gold dot vanish. Each factor doesn't just add difficulty, it multiplies it. One lock leaves the way in easy to spot; stack a few and finding it becomes a needle-in-a-haystack job no thief will take. Every grey dot is a wrong guess; only one gold dot is the way in.
Beyond the three factors, serious systems add two clever extras that don't check you at all. They check your situation.
Access only works from an allowed place. Your bank flags a login from another country because you were in London an hour ago.
Access only works at allowed hours. A bank vault that physically cannot open until 9am is a time lock, and even the manager can't rush it.
The best locks don't just ask who you are. They ask where and when too.
Now let's climb to the very top. Deep inside a military installation sit the codes that can launch a nuclear missile. If any lock had to be perfect, it's this one. So how do they do it? By stacking every idea in this guide at once.
Retina and fingerprint scans confirm the officer's body before the corridor even opens.
A physical keycard and a sealed launch key that only exists in two safes.
A memorised code, changed constantly, written down nowhere.
The commands only work from inside the buried, shielded control room. Nowhere else on Earth.
Two officers must turn two keys at the same second, set far enough apart that no single person can reach both. One human is never trusted alone.
The deepest security idea of all: no single person is ever trusted alone.
This is why the highest secrets use "need to know": a rule that access is exclusive to the few people whose job genuinely requires it. Not your rank, not your curiosity, only your need. Fewer people who can open a door means fewer people who can be tricked, bribed, or make a mistake.
Here's the deepest truth in all of security, and almost nobody says it out loud:
Perfect security is perfectly useless. A door that never opens is the safest door there is, and no use to anyone.
Every lock sits on a dial between two extremes. Slide it and see what you gain, and what you give up.
There's no "correct" spot on this dial. A diary needs a tiny lock. A missile silo needs the whole dial. The skill is matching the lock to what you're protecting: enough to stop the threat, not so much that you can't get in either.
Good security isn't the strongest lock. It's the right lock for what's behind the door.
The best lock isn't the one nobody can open. It's the one nobody can be bothered to.
Most attackers are opportunists, not masterminds. They want the same easy access you have, just without paying or waiting. They wander down the street trying doors, and they take the one left unlocked.
So you rarely need a perfect wall. You need enough resistance that breaking in costs more effort than the prize is worth. Pile on friction and the opportunist quietly gives up and finds an easier target.
It works because you're attacking their laziness. Every extra factor is another hour of work they'd rather not do.
Security is rarely about being impossible. It's about being not worth it.
An attacker wants the least effort possible, so they live at the bottom of this chart. Drag the slider to add security and watch their effort climb.
Where the attacker's rising cost crosses the fixed reward, they quit. You don't have to reach "impossible". You only have to get past that line. Everything to the right of it is a target not worth attacking.
Notice the catch, shown by the faint rising line: every lock you add also lifts your own effort to get in. More security makes a secret harder to reach for everyone, including the person who owns it. That is the price of safety, paid in convenience.
Five questions. Get four or more right and you officially understand security better than most people alive.
The same friendly, ten-minute treatment for two technologies sitting right next to security in your pocket:
I'm building a whole collection of free tools and friendly guides exactly like this one, with no paywalls and no sign-up walls.