A voice CAPTCHA, not just a password read aloud.
When you registered, you chose a personal 4-digit PIN and said it out loud, twice. Nobody else ever sees it typed out, and Vokey never speaks it back to you.
Every time you sign in, Vokey shows you one random digit and asks you to work it into your PIN as you say it — either before, in the middle of, or after your four digits. Which position gets used isn't always the same: it changes on its own, on a schedule, without you having to do anything.
That's on purpose. If the same position were used every single time, anyone who overheard you say it once would have everything they need to repeat it later. Rotating the position — automatically, on the server's own schedule, never something you have to remember to change — closes that gap without adding a single extra step for you.
Think of it like memorizing a phone number instead of carrying it written down: the effort is real, but it's what makes the whole thing hard to fake.