BetterSign™ Get early access

One identity · Three products

Your identity, on a device you hold.

Provenance-based identity, held on your phone.

BetterSign gives you a permanent identity built from math, not secrets. Sign in without a password. Keep the passwords you still need on your phone, not in your browser. And for companies, run sign-in with no passwords anywhere.

A VLAD-anchored provenance log with keys sealed in your phone’s secure hardware. Sign-in is a fresh signature anyone can verify. Stored credentials are approved per request and sealed to a single browser tab. Organizations run their own IdP on the same core.

  • BetterSign App: sign in, verify contacts, and message without a password
  • BetterSign Passwords: your vault on your phone, filled into any browser on approval
  • BetterSign for Organizations: replace your company’s identity provider, one group at a time
  • App: challenge-response sign-in, verified against your plog
  • Passwords: HPKE-sealed fills, approved on the vault-holder device
  • Organizations: self-hosted OIDC/SAML/SCIM IdP over a quorum-signed org log
Get early access See the products

A stable name on the outside, freely changeable keys on the inside.

The products

Three products, one identity.

All three run on the same BetterSign identity. The App replaces passwords wherever a site supports it. Passwords keeps the ones you still need somewhere safer than your browser. Organizations removes passwords from an entire company.

BetterSign App

Beta · iOS & Android

Your identity, in your pocket.

Create your identity once, on your phone. Use it to sign in without a password, to prove who you are, and to talk privately with people you’ve verified.

On-device genesis creates Ed25519 signing and recovery keys, an X25519 encryption key, and a VLAD. Keys are wrapped by the Secure Enclave or StrongBox. The identity is published to and resolved over a libp2p DHT.

  • Passwordless sign-in by push, QR, or paste
  • Keys held in your phone’s secure hardware
  • Separate identities for personal, work, and each site
  • Verified contacts and end-to-end encrypted messages
  • Encrypted, passphrase-protected backup
Join the beta How it works →

BetterSign Passwords

Coming soon

The browser never holds the vault.

Your saved logins live in the BetterSign app on your phone. When a site asks for a password, your phone buzzes. You check the site, approve with your face or fingerprint, and the login is filled in. A stolen laptop has no vault to steal.

The extension is a paired device holding only a signed pairing grant: authorization to ask, not secrets. Each fill is approved on the vault holder with number matching and sealed with HPKE (X25519 / AES-256-GCM) to a key that exists for one request only.

  • Every fill is approved on your phone with a matching code
  • Lookalike sites get nothing: the browser, not the page, reports the site
  • Password generator, 2FA codes, and import from other managers
  • Chrome, Edge, and Brave first, then Firefox and Safari
Get notified How it works →

BetterSign for Organizations

Design partners

Replace your IdP. Keep nothing to steal.

Your company runs its own sign-in service. Employees sign in with a key on their phone, and no password exists anywhere. Start beside Okta or Entra, then replace them one group at a time.

A self-hosted IdP: OIDC, SAML, SCIM and CAEP hosts in Go, Java, .NET and Python over one Rust verification core. The directory is an org provenance log controlled by an m-of-n admin quorum.

  • No password database and no reset desk
  • Leavers lose access everywhere within seconds
  • A directory that needs several admins to change
  • Web SSO, SSH, VPN, and Wi-Fi from one identity
  • Works with Okta, Entra, Ping, Keycloak, and AD FS
Talk to us Learn more →

BetterSign App

Sign in with a tap. Nothing to steal.

When a site supports BetterSign, there’s no password field. The site asks your phone, you approve, and you’re in. The site never stores a secret that could leak, and a fake page has nothing to grab.

The relying party issues a fresh challenge. Your phone signs it with the current key for that site’s identity. The verifier resolves your VLAD to the provenance-log head and checks the signature. There’s no shared secret, no password database, and nothing replayable on the wire.

  1. A site shows a sign-in request, by push notification or a QR code.

  2. Your phone shows who’s asking. You approve with your face, fingerprint, or PIN.

  3. Your phone signs that one request. The secret key never leaves your device.

  4. The site checks the signature against your public identity, and you’re in. No account database is needed.

BetterSign Passwords · coming soon

For the sites that still want a password.

Most of the web still asks for a password. BetterSign Passwords keeps them in the app on your phone, not in your browser and not behind one master password. Every fill is approved on a device you hold.

The vault is encrypted under a key wrapped by the phone’s secure hardware. A paired browser can only send a signed request. The response is sealed to a one-time key for that tab, so each fill has its own forward secrecy. The relay sees only ciphertext, a hashed recipient, and timing.

  1. Click Sign in with BetterSign on any login form, or press ⌘⇧L.

  2. Your phone shows the site, which browser is asking, and a matching code.

  3. Approve with your face or fingerprint. The login is sealed to that one tab and filled in.

  4. The relay that carried it keeps nothing, and the request expires within minutes.

BetterSign for Organizations · design partners

Replace your identity provider without a flag day.

Run it beside Okta, Entra, Ping, or Keycloak. Prove it in a sandbox, add it as a factor, make it the only way in, then retire the old system. Stop at any stage, one group at a time.

  1. 0 · ProveA sandbox, your IT team, and one test app
  2. 1 · FactorA phishing-resistant factor in your current IdP
  3. 2 · PrimaryMigrated users have no password at all
  4. 3 · AuthorityThe org log is the directory; retire the old IdP
∅

No credential database to breach

The sign-in service holds nothing that proves who someone is.

⛓

A directory that can’t be quietly edited

Every hire, role change, and departure is signed by an admin quorum.

⚡

Leavers gone in seconds

Every app hears about it at once, and sessions end.

See the evaluation path All the benefits

What changes

Where your secrets live.

Passwords as usual

  • ✕Every site stores a secret that can leak in a breach
  • ✕One master password unlocks the whole vault
  • ✕An unlocked vault sits in the browser, a prime target
  • ✕Fake login pages trick people into typing secrets
  • ✕Your login belongs to whichever company issued it

With BetterSign

  • ✓Supporting sites store no secret at all, only your public identity
  • ✓Each sign-in or fill is approved on a device you hold
  • ✓Browsers can only ask; the vault stays on your phone
  • ✓Lookalike sites get nothing to fill and nothing to phish
  • ✓Your identity is yours, provable by anyone without a middleman

Under the hood

One identity powers all three.

Your BetterSign identity is a permanent name with a signed logbook behind it. Anyone can check that logbook, and no company sits in the middle.

A VLAD (Verifiable Long-lived ADdress) binds a nonce to the CID of a WASM verification function. It commits to a verifier, not a key, and resolves through a Kademlia-style DHT to the head of a hash-linked provenance log.

◇

A permanent name

Your VLAD stays the same for life, even as the keys behind it change.

The VLAD isn’t derived from a key, so it survives rotation. Key history lives in the log.

⛓

A history anyone can check

Every change is signed and linked, and anyone can verify it, even offline.

Each entry’s proof must satisfy the previous entry’s WASM lock script, from genesis to head.

⇋

No middleman

A shared network address book helps people find you. It never decides who to trust.

The DHT maps VLAD to head CID for discovery only. Validity comes from replaying the log.

◉

Keys you hold

Your private keys are sealed in your phone’s secure chip and never leave it.

Non-exportable TEE wrapping: Secure Enclave on iOS, StrongBox/Keystore on Android.

Questions

Frequently asked.

If BetterSign replaces passwords, why build a password manager?

Because most of the web still asks for one. The BetterSign App signs you in with no password wherever a site supports it. BetterSign Passwords covers everywhere else, using the same identity and the same approve-on-your-phone habit, so you get the benefit today without waiting for every site to catch up.

Can I use it today?

The BetterSign App is in beta on iOS and Android, and desktop versions are on the way. BetterSign Passwords and its browser extension are in development, starting with Chrome, Edge, and Brave. BetterSign for Organizations is being built with design partners. Ask for early access and we’ll bring you in.

Does my password vault sync to the cloud?

No, by design. One device you choose, usually your phone, holds the vault. Your browsers and computers send it requests but never keep a copy. To move the vault to a new device, you export it and import it, and encrypted backups let you restore it.

What happens if I lose my phone?

Restore from your encrypted, passphrase-protected backup on a new device. The browsers you paired can’t do anything on their own, because they only ever had permission to ask.

Can a company take my identity away?

No. Your identity belongs to you, not to us or any other provider. Anyone can verify it with math, with no account on their side and no permission from us.

Do I need to understand the cryptography?

No. You approve requests on your phone and BetterSign handles the rest. If you’re curious, flip the toggle at the top to Technical, or read the open-source core.

Start with one identity.

Join the App beta, be first in line for BetterSign Passwords, or bring BetterSign to your company.

Get early access Read the code