Exploration · 2026-05-01

Voice as password

The audio analogue of image-as-password. Speech is harder than images: every recording is noisy in different ways, microphones colour the spectrum differently, and the same speaker varies their delivery from one take to the next. The same coarse-canonicalize-then-hash idea still works — you just normalize on the time-frequency representation instead of the pixel grid. Record two clips below to see what survives.

Step 1

Explore the pipeline

Two-slot comparison with byte-level deltas. Record or upload two clips to see how a perceptual audio hash treats variation between the takes.

Slot A
Drop · Click
WAV, MP3, OGG, M4A, WebM. Click to pick a file or drop one in.
Slot B
Drop · Click
WAV, MP3, OGG, M4A, WebM. Click to pick a file or drop one in.
Pipeline: decode → 16 kHz mono → trim silence → pre-emphasis → peak-normalize → fit to 3.0 s → 512-pt STFT → 40-band log-mel → MFCC. Three hashes: melPHash (DCT), melDHash (time deltas), mfccHash.
Load audio into both slots to see the match verdict and confidence.

Byte-level deltas

Load both slots to inspect byte-level deltas.

Pipeline visualization

no audio yet
no audio yet
Step 2

Enroll a reference voice

Record the same fixed phrase you intend to use as your password. The Enroller emits a snippet you can drop into any client page.

Reference voice
Drop · Click
WAV, MP3, OGG, M4A, WebM. Click to pick a file or drop one in.
Step 3

Try the gate

VoicePasswordGate is a design-system component. Anything inside renders only after the user records a matching voice clip.

Enroll a reference voice clip. Once you do, this section becomes a real VoicePasswordGate — record again with the same speaker and phrase to unlock.

Step 1 — enroll
Drop · Click
WAV, MP3, OGG, M4A, WebM. Click to pick a file or drop one in.
The gate will appear here after enrollment.
Reference

Pipeline notes + threat model

  1. Pick a short fixed phrase (~2-3 seconds) you can repeat reliably. Phrases with mid-frequency content (consonants, distinct prosody) hash more reliably than long vowels or whispered speech.
  2. Enroll on the same microphone and acoustic environment users will unlock from when possible. The pipeline tries to compensate (peak normalize, pre-emphasis, mel-scale) but a built-in laptop mic and a studio condenser produce meaningfully different spectra.
  3. Default to tolerance="loose" for a v1. Voice has substantially more take-to-take variation than images, so the thresholds are wider than the image-as-password equivalent. Tighten to standard after measuring real attempt distances on your enrolled phrase.
  4. The gate persists an unlock in sessionStorage keyed on the storage key plus the expected hash. Bumping storageKey invalidates existing unlocks across the app.
  5. Pass debug while developing — the failure panel surfaces per-hash distance and threshold so near-misses are visible.
What survives, what doesn't
  • Survives well: re-encoding (Opus/AAC), mild background noise, small amplitude differences, sample-rate conversion.
  • Survives sometimes: different microphones, mild emotional variation, slight rate changes (faster/slower delivery).
  • Breaks: different speaker, different phrase, heavy reverb/echo, aggressive denoising, time-stretching beyond ~10%.
Threat model

VoicePasswordGate is a UX gate, not a security control. Expected hashes ship in your client bundle and the matching runs in the browser. A 64-bit perceptual hash is also far weaker than a real speaker-verification model — anyone who can imitate the cadence and timbre passably (or play back a recording of the enrolled clip) can unlock. Don't put real secrets behind it.