Sign In 🪪

SigNote has no passwords. You prove who you are with a passkey, an emailed one-time code, a Google account, or an Ethereum wallet — and you can link several of them to the same account.

Authentication options

Email code — the simplest option

Type in your email address and SigNote mails you a six-digit code. Enter it and you're signed in.

• Signing up and signing in are the same step. If the address is new, the account is created; if it isn't, you're signed back into the account you already have.
• Nothing to remember. No password exists, so there is none to reuse, forget, or leak.
• The code is short-lived. It expires after 10 minutes, works once, and dies after five wrong guesses.

The code itself is never stored — the server keeps only a keyed hash of it, so a leaked database gives up no live codes.

Google — the fastest option

Google OAuth provides a familiar, quick sign-in experience. If you already have a Google account, signing in takes seconds.

• Familiar flow — Uses the standard OAuth 2.0 protocol that you likely know from other apps.
• One-click sign-in — No wallet connection, no message signing.
• Account linking — You can link Google alongside any other method.

Passkeys — the device-native option

A passkey lets you sign in with the fingerprint reader, face unlock, screen lock, or security key you already use. The private key stays with your device or password manager; SigNote stores only the public credential needed to verify it.

• No password or code — The authenticator confirms your presence locally.
• Phishing-resistant — A passkey is bound to SigNote's domain and cannot be replayed on a lookalike site.
• One account, several passkeys — Add a phone, laptop, or security key from Profile → Sign-in Methods → Passkeys.

Passkeys sign you in to the account only. They do not replace the passphrase that unlocks Secrets and Seals.

SIWE — the anonymous option

Sign-In with Ethereum (SIWE) is an open standard for wallet-based authentication. There's no username, no email address, and no password involved.

• Completely anonymous — Your Ethereum address is your identity. If you use a clean address, no one can track you.
• Domain-bound — SIWE signatures are cryptographically tied to the app domain, preventing phishing attacks.
• No external account required — All you need is an Ethereum wallet.

SIWE is ideal if privacy and anonymity are your top concerns: it is the only method that involves no email address at all.

How SIWE works

What is SIWE?

SIWE is a simple protocol: instead of proving who you are with a password, you prove it by signing a message with your private key. Only the holder of the private key can produce a valid signature, so a successful sign-in proves you control that wallet address — without ever revealing the key itself.

This is the same cryptographic mechanism that authorises transactions on Ethereum. It's battle-tested and well-understood.

Sign-in flow

Here's what happens step by step when you sign in with SIWE:

1. Nonce request — The app requests a one-time nonce from the server. This prevents replay attacks; each nonce can only be used once.

2. SIWE message — A SIWE-formatted message is assembled. It includes the app domain, your wallet address, the nonce, and a timestamp.

3. Wallet signature — Your wallet prompts you to sign the message. Your private key never leaves your device; only the signature is sent.

4. Server verification — The server verifies:

   • The signature is valid for the claimed address
   • The domain matches the app's configured origin (prevents phishing)
   • The nonce is fresh and hasn't been used before

5. Session issued — A JWT session is created and tied to your wallet address. It's valid for 7 days.

Why SIWE over passwords?

Passwords are weak because people reuse them, forget them, and they can be phished. A wallet signature can't be phished the same way — the message you sign includes the domain, so a signature for evil.com won't be accepted by signote.tech.

Domain binding security

SIWE messages include the domain of the app. The server rejects any signature where the domain or origin doesn't match its configured NEXTAUTH_URL. This means a signature obtained on a different site cannot be replayed against SigNote's API.

→ See the Threat model for a full discussion.

How Google OAuth works

Sign-in flow

When you sign in with Google:

1. You click "Continue with Google"
2. You're redirected to Google's authorization page
3. Google confirms your identity and asks for permission
4. You're redirected back to SigNote with an authorization code
5. SigNote exchanges the code for your Google profile info
6. A session is issued and tied to your account

Your Google password never comes to SigNote — Google handles all authentication.

Privacy considerations

Signing in with Google means SigNote receives some basic profile information (email, name, profile picture) from Google. If privacy is a concern, consider using SIWE instead.

Account linking

You can link multiple authentication methods to the same SigNote account. This is useful if:

• You want to sign in with a wallet most of the time but occasionally from a device that has none
• You're migrating from one method to another
• You want a backup way to sign in

How to link accounts

1. Sign in with the method you already have
2. Go to your profile settings
3. Choose the method you want to add — a passkey, email address, Google account, or wallet
4. Complete that method's flow: approve the authenticator, enter the emailed code, approve OAuth, or sign the SIWE message
5. Your account is now reachable through either

Once linked, every method reaches the same account and the same encrypted notes. Your encryption key material stays tied to your passphrase, not to any authentication method.

Security implications

Linking accounts does not weaken your encryption:

• Your Secrets and Seals remain encrypted with your passphrase
• The passphrase is never tied to a wallet, a Google account, or an email address
• Any linked method can unlock your notes once you've re-entered your passphrase

Linking does, however, widen the door: your account is only as secure as the weakest method attached to it. If any one of them is compromised, an attacker can sign in as you. Keep every linked wallet, mailbox, and Google account secure, and remove methods you no longer use.

What gets cleared on sign-out?

When you sign out:

• Your session token is invalidated
• The Master Encryption Key (MEK) is cleared from memory
• The device share (deviceShare) is cleared from sessionStorage
• Trusted Authenticator keys and their encrypted local credential cache are deleted

This means your encrypted notes are immediately inaccessible until you sign back in and re-enter your passphrase.

Sign-out works the same way regardless of which authentication method you used.

Passphrase vs. sign-in

💡 Note: The passphrase you set up for Secrets and Seals is a separate thing — it's used for encryption, not for signing in. You can be signed in without having unlocked your encrypted notes.

Your sign-in — whichever method you used — gives you access to your account and Tier 1 notes. Your passphrase unlocks the encryption for Secrets and Seals. They are independent — changing your sign-in method doesn't affect your encryption.

→ See Encryption to understand how the passphrase and MEK work separately from authentication.