Your key to the house

How it works

This house knows its people by a key, not a password. When you register, this device makes a key pair for itself: the private half is locked into this device so it cannot be copied out of it, and it never travels. The public half is registered here under its fingerprint. Signing in is the device proving it holds the private half, by signing a one-time challenge. Nothing secret crosses the wire, and there is no password to steal, forget, or reuse.

One key per device: your phone and your computer each register their own, and a short link code from a device the house already knows ties them to one person. Registration uses the site cookie, so the cookie ask comes first if you have not answered it yet, and your registration keeps a one-way scrambled copy of that cookie's number on file next to your key, never the number itself, so the house knows this device is one of its registered ones.

How the house treats a key

A key identifies a device, and the registration ties the device to the name you give. Signing in proves the device, every time, without a password. A session lasts two hours. If a device is lost, recover with the phrase and the old key is revoked on the spot. There is no master key and no back door: a key is revoked only when its owner recovers with the phrase.