Create your card
Your key is made in this browser and never leaves it. No account password. A passphrase protects only your backup file.
This browser already holds a key
This card has no backup file. If this browser’s key is lost, the card can’t be recovered. Make the file now, while this browser still holds the key.
Forget this device
This browser deletes its key. The card stays as it is, with the key listed on it, and this browser can no longer sign for it.
Delete this browser’s key? You can’t undo this. The key stays listed on the card, unused. On a shared or borrowed device, revoke it instead with “Log out and revoke this device” on the device page.
Your name and this device
Your key is made
- Public key
- Private key
- Kept by this browser, which won’t hand it to any page, ours included
- Device
Publishing writes the first version of your card to the public log: your name, this device and its public key. Independent witnesses then sign the log.
This browser can’t make the key yetMaking a key that no page can read needs Ed25519 in the browser’s own cryptography. Current Chrome, Firefox, Safari and Edge have it. Update this browser, or open veil.rip in one of them.
Veil won’t fall back to a key this page could read and copy, because the key has to stay with the browser.
Your card exists
Your fingerprint
Twelve words made from your card’s first version. Read them to anyone who wants to be sure they have the right card. The words on their screen must be the same.
Your backup file
The file holds a recovery key, locked here with your passphrase before it is saved. Put it somewhere you will still have in a year, like a USB stick or your cloud drive.
Skip the backup file? If this browser’s key is lost, your card can’t be recovered. It stays public forever, and nobody can add a device to it or close it for you, Veil included.
Bring your public keys
Do you already use SSH, PGP or minisign keys?
If you don’t know what these are, you don’t need this step. You can add one later from your card.
Add the public half of the keys you already use: SSH, PGP, minisign or ML-DSA. The private key never leaves your machine. You prove the key is yours by signing one challenge with it.
| Key | Show the public key, then sign the challenge |
|---|---|
| SSH: Ed25519, ECDSA P-256 and P-384, RSA | cat ~/.ssh/id_ed25519.pubssh-keygen -Y sign -n veil -f ~/.ssh/id_ed25519 veil-challenge.txt |
| OpenPGP | gpg --armor --export [email protected]gpg --local-user <fingerprint> --armor --detach-sign veil-challenge.txt |
| minisign | cat ~/.minisign/minisign.pubminisign -Sm veil-challenge.txt |
| Ed25519 or ML-DSA, raw | openssl pkey -in key.pem -puboutopenssl pkeyutl -sign -inkey key.pem -rawin -in veil-challenge.txt | base64 |
Your card is live
No backup fileIf this browser’s key is lost, your card can’t be recovered, and nobody can add a device to it or close it, Veil included. You can still make the file from this browser.