Local authenticator

A signing key that refuses the wrong site.

SoftKey generates an ECDSA P-256 key in this browser and seals the private half with your passphrase. It will sign only when the page you are looking at is the origin named in the challenge.

• Origin-bound

  A lookalike cannot reuse the signature.

• Passphrase sealed

  Wrong passphrase cannot unwrap the key.

• This device

  Nothing is uploaded. Forget the phrase and the key is gone.

SoftKey is software on this device, not a hardware secure element. Malware here can still ask you to sign. Origin binding is what stops a fake site.