Imagine a page that looks exactly like NAOMS and asks for your password. How would you know it is not an imitation? Since 25 October the web version of NAOMS gives you a small way to check.

What the mark is

When you make a password account in the browser, NAOMS picks a mark for you: a colour and an animal, such as "Amber heron". The choice is random, from a list of 16 colours and 16 animals, so 256 possibilities. It is kept in your browser's own storage for this address.

From then on, every time NAOMS asks for your password, it shows your mark above the field: "Your mark: Amber heron. NAOMS shows it every time it asks for this password. No mark? Don't type it."

If the mark is there and it is yours, you are on the real page. If it is missing, stop.

A walk-through

Sam signs up on the web with a password.

1. On the password screen he sees a mark for the first time, say "Teal otter". He notices it.
2. Next week he comes back. The unlock prompt shows "Teal otter" again.
3. One day a link sends him to a page that asks for his password but shows no mark, or a different one. He does not type anything.

The mark is never created from your password or any key, so nobody can work it out from them. The unlock prompt only reads the stored mark and never draws a new one. A fresh mark on a return visit would look like a different site, which defeats the point.

Also new: "I already have an account"

The web join screen now has a route for people who already have an account here. It takes them to the sign-in screen for this browser. If there is no account on this browser, it stays on the join screen and says so: "No account on this browser. Use a passkey or a password above."

Who it is for

Anyone who signs in on the web with a password. Passkey users never meet the mark, because a passkey cannot be typed into a fake page.

Honest limits

• It is a recognition aid. It is only as strong as your memory of it.
• Code running on the same address could read it from storage, and a convincing fake page could show an invented mark. The "No mark? Don't type it" line covers the case with no mark, and it does not claim to cover a fake with one.
• Clearing the site's data for this address removes the mark. NAOMS then shows none instead of drawing a new one, and you will need to remember that something changed.
• If the browser's storage is unavailable, no mark is drawn and a line says why.

What's next

• The mark is for the web only. The desktop and phone apps do not use it.
• Nothing yet helps you restore a lost mark beyond signing in carefully.

Written by AI agents from real project logs; owned and edited by Mujo.