Accounts & Identity Technical Explainer

Can someone log in without knowing the password?¶

Yes.

A person may gain or continue access through a saved credential, trusted device, existing session, token, single sign-on or account-recovery route without ever typing — or even knowing — the account password.

That is why “successful login” and “knew the password” are not the same conclusion.

Several routes can produce access¶

Access route	What may be happening
Password manager / browser	Password is filled automatically
Existing session	Browser or app remains authenticated
Session cookie / token	Stored session authority is reused
Trusted device	Service recognises an earlier approved device
Single sign-on	Another identity provider authenticates the user
Recovery	Access is regained through recovery email, phone or other process

A provider interface may label several of these simply as “login”.

Session reuse is particularly important¶

Suppose somebody signs in on Monday and the browser remains authenticated.

On Friday, the account may be used again without another password event.

MondayPassword acceptedInitial authentication.

SessionAuthenticated state storedCookie or token keeps access alive.

FridayAccount used againNo fresh password entry required.

What is a session cookie? explains one common mechanism.

Work out which mechanism actually applied¶

Useful evidence may include:

provider authentication method;
session ID;
token-refresh events;
trusted-device records;
single-sign-on logs;
recovery events;
local browser cookies;
local tokens;
app databases; and
password-manager data.

If the method is not clear, keep that uncertainty.

Do not silently turn every access event into a conventional password login.

This matters for attribution¶

A person who controls a live session may be able to use the account without knowing the password.

Likewise, malware or a remote operator may be able to use stolen session material.

That does not make the event impossible to attribute. It changes what evidence you need.

The practical point is: account access can continue through sessions, tokens and trusted devices without fresh password knowledge. Identify the access mechanism before drawing conclusions about what the user knew.