Single Sign-on
Single Sign-on (SSO) means: you log in once and can then use several different services without having to log in again. The principle is familiar from buttons like "Sign in with Google."
Anyone who spends time on the internet constantly has to identify themselves. Almost every site wants a username and a password. Single sign-on solves this problem differently: you identify yourself just once at a central point. After that, several other services open up without you having to type in a password there again. The German term for this is Einmalanmeldung. The English “single sign-on” means literally exactly that: signing on a single time.
One password instead of fifty bad ones
People cannot remember fifty good passwords. So many use the same one everywhere, or easy variations of it. If a single provider gets hacked, all other accounts are immediately at risk as well. Single sign-on drastically reduces the number of passwords. You can then really make an effort with the one remaining password.
For companies, there’s a second advantage: control. In a company, an employee often uses thirty different programs. If they leave the company, access has to be blocked everywhere. With a central login, a single click is enough. Without it, experience shows that accounts remain open that nobody thinks about anymore.
But there is also a downside. The central login becomes a master key. Whoever cracks it gets in everywhere. That’s why SSO is almost always combined in practice with a second safeguard, such as a code from an app on the phone. Experts call this two-factor authentication.
The ID card the website checks
Three parties are involved in an SSO process. There’s the user, there’s the service they want to use, and there’s the central login point. This point is called the identity provider. Google, Microsoft, or Apple are well-known examples of this.
The process is always similar. You click “Log in” on a page and are redirected to the identity provider. There you enter your password, often only the first time each day. The provider then sends a digital confirmation back to the site. This confirmation is called a token and is something like a forgery-proof day pass.
What’s important is what does not happen here: the password never reaches the website. It only learns that the login succeeded, usually along with the email address. A comparison helps: the bouncer at the club checks your ID but doesn’t keep it. The technical rules for this exchange are called OAuth, OpenID Connect, or SAML. You’ll come across these abbreviations in documentation, but as a user you don’t need to know them.
From the Google button to the company laptop
Most often you see SSO as a button under the login form: “Continue with Google” or “Sign in with Apple.” The school cloud used in many German states works this way too. And in many companies you log in on your laptop in the morning and then have email, calendar, and chat open.
The term regularly comes up in tech industry news. Companies like Okta or Microsoft make money running such login systems. When a security vulnerability occurs there, thousands of companies are quickly affected. SSO is also a selling point for AI tools: business customers often book more expensive plans only because these are the only ones that allow a central login.
A common misconception: a password manager is not single sign-on. It still stores many individual passwords and fills them in automatically. With real SSO, on the other hand, the other passwords don’t exist at all. This is an important difference, even though both feel similarly convenient in everyday use.
