Your fingerprint or face recognition
is actually not “two-factor authentication”
Even if a password leaks, unauthorized logins are not allowed.
applippli-key uses one touch on your smartphone to put Windows login itself behind two-factor authentication, closing the entry point for unauthorized access and ransomware.
Face and fingerprint recognition on a standalone PC is a “password replacement”
not a second factor
Fingerprint and face recognition are convenient, but when added after the fact to a standalone PC with a local account, they are a mechanism that verifies identity with biometrics instead of a password. The internal authentication logic is still a single one. In other words, once that one is broken, it is over: it is still only one factor.
This is not our own opinion; the standards say so. The US NIST (National Institute of Standards and Technology) standard SP 800-63B does not count a face or fingerprint itself as an authentication “factor.” Biometrics can be used as part of multi-factor authentication only when combined with “something you have” (a physical authenticator).
Microsoft itself also states clearly that Windows Hello used with a local account is “not backed by asymmetric (public/private) keys.” Because there is no “key inside the device” to serve as the basis for a second factor, there is only one factor.
However, Windows Hello for Business, linked with Microsoft Entra ID or Active Directory, is different. It combines a key inside the device (something you have) with a PIN or biometrics, and Microsoft describes it as two-factor authentication. Companies without IT staff rarely, if ever, have that set up.
Which login to use when
You normally log in with one touch on your smartphone. Even when the PC or smartphone is not connected to the internet, you can log in with a one-time password.
| When | Internet connection | How to log in |
|---|---|---|
| At your usual place, such as the office or home | PC: onlinePhone: online | One touchJust tap the confirmation that arrives on your smartphone. No password to type |
| Right after starting a PC you took out, such as at a client's office | PC: offlinePhone: online | One-time passwordEnter the six-digit number shown on your smartphone |
| On a business trip abroad, with no Wi-Fi or tethering for your smartphone | PC: eitherPhone: offline | One-time passwordThe number is shown even when the smartphone is offline |
| Using Microsoft Authenticator or Google Authenticator | Does not matter | One-time passwordOne-touch login works with the dedicated applippli Authenticator app |
| You forgot or lost your smartphone, or its battery is dead | Does not matter | Emergency logonIt can be used only a limited number of times. Be sure to set it up when you introduce the product (details) |
> FAQ: How does multi-factor authentication change the way I use my PC?
“Regular password changes”
are outdated
Regular password changes, such as every six months, have become routine at many companies and medical institutions. However, the US National Institute of Standards and Technology (NIST) and Microsoft do not officially recommend this. Forced password changes actually lead to employees reusing simple passwords, which raises security risk rather than lowering it.
Unauthorized access is “the user's own login”
When we hear “cyberattack,” we picture someone breaking through a wall. In reality, that is not how it happens. Attackers use an ID and password obtained somewhere and openly log in as the user.
This is the most troublesome part. Because they come in with the user's own ID and password, to the system it looks like nothing but a “legitimate login.” It is not even the “impersonation” that the words “unauthorized access” bring to mind; in the records, it is the user's own login. There are mechanisms that detect access from unusual locations, but as long as the entrance itself is opened with the correct key, it is not easy to spot. Attackers exploit exactly this to threaten companies' businesses.
That is exactly why two-factor authentication (also called 2FA, or multi-factor authentication / MFA) works. Even after an ID and password have leaked, only the genuine user can pass the additional check.
A Microsoft study analyzing real Azure Active Directory data reported that even where the ID and password had already leaked, multi-factor authentication reduced the risk of compromise by 98.56% (a 99.22% reduction overall).
Source: Microsoft Research, “How effective is multifactor authentication at deterring cyberattacks?” (2023, arXiv:2305.00945)
https://arxiv.org/abs/2305.00945
Microsoft also states on its own security blog that multi-factor authentication can block more than 99.9% of account compromise attacks.
Source: Microsoft Security Blog, “One simple action you can take to prevent 99.9 percent of attacks on your accounts” (August 20, 2019)
https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
One touch on a smartphone is convenient, and it also protects your business.
Most ransomware starts with a “login”
Vulnerabilities in VPN or RDP, or leaked and reused passwords. Attackers first log in with a legitimate ID and password, then break into and spread through the internal network, and finally encrypt files and demand a ransom.
In other words, simply securing the login entrance with two-factor authentication can stop much of the chain of damage at the very first step. By making that entrance a one-touch action on a smartphone, applippli-key also frees users from the hassle of typing passwords and the burden of remembering them.
How many attacks
multi-factor authentication stops
Many incidents start from a single “weakness in authentication.” Strengthening login authentication with a second factor is one of the most basic and reliable measures, and a highly cost-effective one.
“There are so many products
I don't know which one to choose”
The number of security services and devices keeps growing every year. In fact, many people in charge tell us, “In the end, I can't decide which one to choose.”
If you are unsure where to start, the answer is simple: put multi-factor authentication (MFA) on “server login,” where your important data is concentrated. That completes the “top-priority move” with the highest cost-effectiveness. With applippli-key, you can do it in as little as 5 minutes and at low cost.
Two-factor authentication
for your existing PCs and servers, as they are
applippli-key is a solution that puts Windows login behind two-factor authentication with one touch on your smartphone. When the PC or smartphone is offline, you can log in with the one-time password (TOTP standard) shown on the smartphone. No new server or hardware purchase is needed. It can be installed in your current environment in as little as 5 minutes.
Directly strengthens OS login (Windows login)
Rather than individual apps, it puts two-factor authentication on the most targeted point itself: “OS login to the PC.”
Supports the TOTP standard
In addition to our dedicated app, it works with standard authenticator apps such as Google Authenticator.
Simple design that needs no specialist knowledge
Even without dedicated IT staff, you can start using it just by following the setup wizard.
Do any of these sound familiar?
- A business partner asked you to explain your security measures, and you could not answer clearly
- You worry about intrusions via VPN or RDP
- You have UTM and endpoint protection, but login protection has not been addressed
- You have no dedicated IT staff and cannot run complex systems
- You want to start with a subset, such as administrator accounts, and roll out step by step
There are gaps that UTM and endpoint protection
alone cannot fill
Each measure has its own area of coverage. “Stronger login authentication” is an area that many companies overlook.
| Attack scenario | UTM (perimeter defense) | applippli-key (login authentication) | Endpoint (device defense) |
|---|---|---|---|
| Blocking unauthorized traffic and intrusion from outside | ✓ | ✗ | ✗ |
| Theft and misuse of credentials | ✗ | ✓ | ✗ |
| Blocking impersonation logins | ✗ | ✓ | ✗ |
| Preventing malware execution | ✗ | ✗ | ✓ |
applippli-key does not replace your existing measures; it is the piece that covers the often-overlooked “entrance” and completes your defense in depth.
“Can it also be used for two-factor authentication on routers and VPN devices?”
Because applippli-key provides OS-level authentication, it does not support two-factor authentication for router devices.
In recent cyberattacks, a common technique is to first steal (crack) the passwords of routers and VPN devices, then crack the passwords of PCs and servers to break in. As advisories such as “Ensuring thorough security measures in response to exposure of credentials for Fortinet devices” show, leaks of network device credentials really do happen.
Even if router or VPN device passwords are cracked and the attacker gets into the network, applippli-key's role is to “not allow” intrusion into PCs and servers. It has been reported that with multi-factor authentication, the risk of compromise fell by 98.56% even when credentials had already leaked (Source: Microsoft Research, arXiv:2305.00945 / 2023).
In short, the area covered by network device makers such as Fortinet and the area covered by applippli-key are different. Perimeter protection plus login authentication protection: having both completes your defense in depth.
In as little as 5 minutes
up and running in 4 steps
Download
Get the PC software.
Install
Install it with a double-click.
Activate
Register your license key.
Initial setup & pairing
Pair it with the smartphone app, and you are done.
Choose to match the scope you want to protect
Standalone edition (for PCs)
Puts two-factor authentication on login to individual PCs. You can roll it out step by step, starting from a single PC.
Server edition
Supports on-premises and cloud servers, protecting a wider scope.
Licenses are counted by “number of devices,” not number of users. Even if more people use the PC, there is no additional cost, which keeps costs down.
Server edition only: visibility setting for login access logs
When you install the Server edition of applippli-key on a server, you can record and review login access logs and threat detection logs for that server. Administrators can see who logged in and when, and whether there were any suspicious login attempts.
The Server edition has an ON/OFF setting that lets you choose whether to show these logs to all users who log in to that server, or limit them to administrators only.
| Standalone edition | Server edition | |
|---|---|---|
| What login access logs and threat detection logs record | Only logins to that PC itself | Only logins to the server where it is installed |
| Log visibility setting | — | Can be set ON or OFF |
| When set to ON | — | All users who log in to that server can view the login access logs and threat detection logs for that server |
| When set to OFF | — | Only administrators can view the login access logs and threat detection logs for that server |
The Standalone edition does not have this visibility setting; each PC's login records can be viewed only on that PC.
Solidly built, so you can use it with confidence
Detects attempts to get around it and locks out immediately.
Protects information with strong encryption.
Supports display in Japanese and English.
We provide our products under the following certifications and partnerships.
Hear from people
who actually use it
We share real voices from the field, such as “We were freed from complicated passwords” and “We can now explain our security to business partners.”
See case studies and customer voices →Protect your company at the login entrance
Start by reviewing our materials, or see your company's risks with a free 3-minute check
WHY STRENGTHEN SECURITY