What this demo proves
The access key is remembered in the user's mind as a route through a changing dial. There is no standard password field and no plain typed secret placed into the page.
Try it without a server
Enter the route, not a typed password.
Drag the dial until the next highlighted code item is in the green capture window. Press capture to confirm it. Everything runs inside this browser page.
Demo code
Capture window
How it layers
In a production flow, the dial can sit beside 2FA and biometrics: the dial proves what the user knows, 2FA proves what they have, and biometrics prove who they are.
No server needed here
This example is deliberately static. It draws the dial, shuffles the layout and validates the sample code in browser JavaScript so it can run from a file link.