Behavior-first security
We pick up the rhythm behind your reactions. Shoulder surfing, credential stuffing, and replay attacks have nothing to copy.
GrayPass is a behavioral signature.
GrayPass verifies who you are by how you behave, not what you type.
A short challenge captures the timing of your reactions and the rhythm of your typing.
Those signals collapse into a small, salted vector. The raw behavior never leaves the session.
On every login we recompute the print and decide accept or deny in milliseconds.
Passwords get stolen. OTPs get intercepted. Fingerprints leak. We built an identity layer that refuses to be any of those.
We pick up the rhythm behind your reactions. Shoulder surfing, credential stuffing, and replay attacks have nothing to copy.
Raw behavior never leaves the session. We store a salted print, encrypted at rest, with helper data on a rotation.
If anything ever leaks, we rotate the seed. Your identity stays. The template behind it is replaced in minutes.
Accept or deny in milliseconds, with calibrated confidence ready for your policy engine.
Server-driven schedules with jittered timing. Macros and remote-takeover tools fail the timing tests.
Four short reads. Pick one and you will know what we built and why it matters.
The full enrollment-and-login loop runs end to end in about two minutes. Here's what to expect.
Switch to Enroll mode and pick a username. It can be anything we will remember it for you.
Turn on your webcam if you want gaze tracking. No camera works fine too the rest of the signals stand on their own.
You will see color words written in different colors. Click the bar that matches the actual color, not the word.
Type a short phrase at your natural pace. We measure rhythm, not speed. Slower is fine.
Switch to Login, type the same username, and run the tests once more. If your behavior matches, you are in.
Two sentences are enough. We read almost everything and reply to most.
Get an API key in minutes. The SDK runs in the browser. Your stack doesn't have to change.