Account
This site is static — it is served as files, with no server behind it and no database to keep an account in. So a profile here lives in this browser. It is not authentication: there is no password, nothing is verified, and anyone using this browser can switch to any profile on it.
What it does buy you is real. Two people sharing a laptop stop overwriting each other's progress, and an export moves everything you have done to another device.
Sign in with an account
If this deployment is configured with an identity provider, you can sign in with a real credential instead. That is verified: the password is checked by the provider, never by this page, and the session it returns is accepted only after its signature is checked against the provider's published keys. A token this site merely decoded would prove nothing — the payload of a sign-in token is readable by anyone, so reading a name out of it is not the same as knowing it.
The key this page ships is a publishable key. It is meant to be public and is safe to read, because the database enforces row-level security: the key alone cannot reach anybody's rows, only a verified sign-in can. If you are forking this site, that is the setting to check first.
Sign in with an OpenID Connect issuer. This is a real Authorization Code + PKCE flow: the page redirects to the issuer, exchanges the code it gets back, and verifies the returned ID token's signature before it means anything.
This deployment has no identity provider configured, so only device profiles are available here.
Sign in
A name you have used before reopens that profile. A new one starts empty.
Signed in as
Everything you mark done is recorded against this profile.
Move this profile to another device
Export writes a JSON file holding the profile and its progress. Import it in the other browser and you carry on where you stopped. This is the honest version of "your account follows you" on a site with nowhere to sync to.