Sign in with a passkey, skip Client Trust when 2FA is on, get real password-strength scoring at signup, and run into bot challenges only when traffic looks suspicious.
Four account-security improvements ship together today: passkey login, Client Trust deferring to 2FA, zxcvbn-ts password scoring, and a smart CAPTCHA on sign-up.
Existing sessions are unaffected.
Passkeys are now a supported authentication method for Novu accounts.
Sign up with email and password or SSO as usual, then add a passkey from Account settings → Security.
Your platform authenticator (Touch ID, Windows Hello, a hardware security key or a password manager like 1Password or iCloud Keychain) handles the rest.
On your next sign-in, pick Sign in with passkey.
Passkeys are built on WebAuthn. The private key never leaves your device, so there's nothing phishable for an attacker to capture on our side.
You can register up to 10 passkeys per account, and they stack alongside your password and 2FA. Passkeys are an additional method, not a replacement.
Client Trust is our defense against credential stuffing: when someone signs in with a valid password from a new device, we send a one-time code to their email or phone.
The catch was that this fired even on accounts with 2FA already enabled. Signing in from a new laptop meant two prompts: enter your TOTP code, then approve the new device.
That's now collapsed into the regular MFA flow.
If you have 2FA configured (TOTP, SMS or backup codes), Client Trust skips automatically. Your second factor already covers the new device.
If you don't have 2FA enabled, behavior is unchanged: new devices still require a verification code by email or phone.
This only applies to password sign-ins. Passkeys, OAuth and email links bypass Client Trust entirely.
If you've been meaning to turn on 2FA, this is the nudge.
Password strength at signup, change and reset is now scored with zxcvbn-ts, the OWASP-recommended library for measuring real password entropy rather than pattern-matching "8 characters, one number, one symbol."
You'll see live strength feedback as you type, and a prompt when a password technically meets the basic rules but is still weak (Password1!, qwerty123, dictionary words with predictable substitutions).
This sits on top of our existing NIST-based minimum requirements.
Sign-up is where bots show up first.
We've moved off the old invisible CAPTCHA and onto a smart variant that uses CDN-level signals to decide whether a sign-up attempt looks suspicious.
If it does, the user gets a quick interactive challenge (typically a checkbox). If it doesn't, which is most of the time, the challenge stays out of the way.
Less friction for real users, more for the scripted ones.
