A home for your rootcard ID.
rootcard is an open standard for logins you own: servers can check that you are you, but they can never become you, never learn your password and never keep you from moving. rootcard.org is one of the homes that issue and hold rootcard identities, free to use and with nothing to install.
Early software. rootcard 0.3.1 is pre-1.0 and has not had an external security review. Use it to try things and for low-value accounts, not yet for anything you cannot afford to lose.
One home among many.
A rootcard identity lives at a home: a server that keeps its public log and encrypted vault and lets you sign
in. rootcard.org is a public home for the global realm, run on the open-source
rootcard-host. It is not the rootcard project's central server, because there is none.
Who runs it and what it keeps.
What it keeps
Your public log, your public profile and your vault, encrypted in your browser before it is sent. You can download all of it as one file at any time.
What it cannot do
Read your vault, learn your password, reset it for you, or sign in as you. Your id is signed by your own recovery key, so this server cannot change or forge it.
Where else you can go
Any other rootcard home, or your own server with rootcard-host. With the recovery card you move
in minutes, and your id, handle and password come along.
A username, a password and a card in a drawer.
Create
Pick a username and a password. Your browser makes the keys and a recovery card for you to download or print. Only then is the signed, encrypted registration sent here.
Sign in and prove
Sign in here to edit your profile and private data, and make proofs that any service can check against your public log, without asking rootcard.org.
Keep the card
The recovery card resets a forgotten password and moves you to another home with the key tool. Nobody else can do either for you.
How the signatures, the two power levels and the comparison with passwords and passkeys work: About rootcard. Building on it: Developers.
Good to know
What happens if I lose the recovery card?
The identity keeps working with your password, but it can no longer be reset or moved. If you then also forget the password, the identity is gone. Nobody, rootcard.org included, can recover it: that is the point.
What if rootcard.org disappears?
With the recovery card your id and handle survive on any other host. With the card and a downloaded account file, everything moves: private data, profile and passwords.
Why is the key tool a file I download?
The recovery key is never typed into a page a server delivers live, because that server could change the page. The key tool is a single HTML file from the npm package that you open from your own disk. It talks only to the hosts you enter.
Can services link my accounts?
Every service gets its own proof, valid only for that service. If you do not want services to link your accounts, create several identities: they cannot be linked by their public data.