Prove an email is yours

Steps

1. Create an account with your name, email address and a password.

   What the server checks: Your account record exists.

   Registration creates a record. On its own, a record says nothing about who controls the email address.

2. Enter the six-digit code from the email, or open the link it contains.

   What the server checks: Your account's email address is marked as verified.

   Only someone who can read that mailbox can return the code. The code works once and is stored only as a hash, so the database never holds a value anyone could replay.

3. Finish registration so you are signed in, then come back to this page.

   What the server checks: This browser holds a session for the verified account.

   The session connects your later requests to the account you just established.

Do it

The server checks your own account records and sign-in history, and shows only whether each step is done. It never shows the events themselves. An account counts only once its email address is verified.

Sign in to complete this lab and check your progress. Log in or create an account.

Learn the theory

• Establishing an identityCreating a record
• Establishing an identityWhat verification proves
• Codes, links, and approval promptsDelivered codes and links
• What is Identity?Claims and evidence