Deterministic passwords derived from a VerusID spending key. No master password, no database to breach — just pure cryptographic derivation.
Live Demo
How It Works
Your VerusID spending key signs a fixed message. The resulting signature is hashed to produce a stable wallet secret that never leaves your device.
HMAC-SHA256 combines the wallet secret with a site-specific label (site name + counter) to derive a unique, per-site key. Changing the counter rotates the password.
The derived key is encoded to the site's charset profile (full, alphanumeric, or PIN) and trimmed to the requested length. Deterministic and reproducible every time.
Key Features
Your VerusID spending key is the only secret. No additional master password to remember, forget, or have phished.
Passwords are derived on demand, client-side. The vault stores only metadata (site, username, charset, length) — never the passwords themselves.
Increment the counter for any entry and a completely new password is derived. No complex migration — just bump and re-register.
Vault metadata can sync anywhere freely. As long as you can sign with your VerusID on the new device, all passwords regenerate identically.
Vault Entry Schema