Why you'll want it
A leaked password isn't the end
With login approvals, a login to a connected website only goes through after you approve it in allme. Someone who only has your password gets nowhere.
Deny in one tap
Not you? Tap Deny — no unlocking needed. Approving asks for your fingerprint or password first, so nobody else can approve a login on your phone.
Your allme account, protected too
Turn on two-factor for your allme account with an authenticator app or a code sent to your email. Mark your own devices as trusted so they don't ask every time.
How it works
01Your login approvals
Websites that use allme to confirm your logins are listed in your account. You can revoke one there at any time.
02A login is waiting
Someone signs in to the website with your password. The website asks allme, and your phone shows the request at once — you can even answer from the notification.
03Is it you?
The request says which website is asking. Approve if it's you, Deny if it isn't. A request nobody answers expires after 5 minutes and counts as a no.
04Denied — and done
Tap Deny and the website is told no. The request is gone from your list, and whoever had your password is stuck at the website's door.
How login approvals work
A website that offers allme login approvals sends each login to your phone and waits for your answer. Approving needs your fingerprint or password; denying needs nothing. Some websites also show two digits on their login page for you to type into allme, so you only approve the login in front of you — three wrong entries deny it. The website hears your answer from allme, and a request nobody answers expires after 5 minutes.
Read the privacy deep-dive →Frequently asked questions
Does this replace the website's password?
No. Login approvals are a second step after the website's own password, for websites that use allme to confirm logins.
How do I protect my allme account itself?
Turn on two-factor in your allme account and choose an authenticator app or a code sent to your email. You also get three single-use backup codes in case you lose access to them.
What if someone keeps guessing my allme password?
After five wrong passwords in a row, signing in with a password is paused for 30 minutes and we email you. Whoever is guessing isn't told.
What happens if I don't answer a request?
It expires after 5 minutes, and the website must treat it as a no.
Do I have to unlock anything to deny?
No. Denying works straight away. Approving asks for your fingerprint or password, so nobody who picks up your phone can approve a login for you.
Can I stop a website from sending me requests?
Yes. Revoke it under Login approvals in your account.