content: Do I have a code I keep on my computer that gets sent to the website I'm trying to log in to?   I only skimmed it, but if I got this right we are simply talking about public key crypto here. What is stored on your device is your key-pair, consisting of a private and a public key (just 256 bits of text in a file). The public key can only be used to encrypt something and never to decrypt something. As such you may safely give it to anyone. The private key on the other hand is stored on your device and should never leave it. Same principle as with PGP/GPG, SSH, TLS/SSL, OTR, etc. So to answer your question: Yes and no. Yes, something is stored on your device and you need to keep that secret. No that thing stored on your device is not sent to the website. And at this point it gets a bit more complicated, you will have to understand hasing and public key cryptography, specifically the concept of "signing". The bottom line is, that it is possible to exchange information with confidentiality and then verify that informations integrity without ever exchanging passwords, pass phrases or keys, that can be used to decrypt any of the information exchanged. However, this very part is tricky to get right, and all the secure protocols only achieved that with the drawback of requiring the human to verify a long string of information that is not human-meaningful (meaning you can't remember "a0s8ydadba97dm23dadz10x1" very well or want to compare it with "a0s8udadba97dm23dadz10x1" each time you make a first contact). This problem was also known as Zookos triangle, which has actually been solved about two years ago - though the solution to that problem is not yet in wide use. My problem with SQRL right now is that I can't figure out whether or not that protocol does the integrity-check of the first exchange. It might be doing it, but based on the documentation and my current tiredness, I can't see how it would be solving the problem of making sure that the QR code you receive on first contact is not spoofed.  If I can move it, does that mean hackers with access to my computer have access to my code as well?  Yes and yes. Rule of thumb: Once someone has access to your private key, you have lost all confidentiality. There are two measures to mitigate this: Revocation keys and perfect forward secrecy. The former is self-explanatory and the second really is not. The short answer here really is that once your device has been broken into, you are open for all sorts of attacks. Even the strongest crypto won't save you from TAOs.