Passport

1 · Zero Footprint

This application runs entirely in volatile memory. It sets no cookies, writes no localStorage, IndexedDB, or Cache entries, and makes no network requests of any kind. Closing the tab destroys all session data. There is no server, and nothing is transmitted anywhere.

2 · Hardening

Your password is stretched with PBKDF2-HMAC-SHA256 at 1,000,000 iterations, producing a 512-bit root. Each key is then separated with HKDF-SHA256 under a distinct domain label, so the Ed25519, secp256k1, and BIP39 outputs are cryptographically independent. Brute-forcing the derived keys requires brute-forcing your password — so password quality is the entire security boundary.

3 · Airgap Strategy

This file is fully self-contained. For maximum security: save this page as a local .html file, move it to a machine with the network interface disabled or removed, and run it there. Nothing about the page requires a connection.

4 · Collision Resistance

Alias space is large and the derived keys are 256-bit. For randomly distributed keys, the probability that two independently generated identities collide is on the order of 1 in 2²⁵⁶. Note that this is a probability statement about random collisions, not a proof that no two inputs ever map to the same output.

What this does NOT protect against

• A weak or reused password — this is the single point of failure.
• A compromised or keylogged machine. If your OS is owned, this page cannot help you.
• Shoulder-surfing and cameras. Mask your screen.
• Anyone who learns your alias and password. Both are required; neither alone is sufficient, but both together reproduce everything.
• Deterministic derivation is a feature for backup and a hazard for compromise. Treat the alias+password pair as the seed.

Legal

Provided as-is, without warranty of any kind. This tool generates cryptographic key material locally. You are solely responsible for the safekeeping of your inputs and outputs. Verify all outputs against an independent implementation before committing funds. Not audited. Not financial advice. Not a substitute for a hardware wallet.

Alias

Your public handle. Use it on Discord, Matrix, Nostr, or anywhere you want a consistent, non-identifying name.

Persona ID

Your unique persona serial. Include it alongside public keys to pin one identity to one persona. Safe to publish.

PVK (Ed25519)

The root of your signing identity. Use it to log into sovereign apps, sign PGP messages, or derive sub-identities. Never publish. Never paste into a website.

Nostr npub

Your public identity on Nostr. Safe to share, publish, or put in a NIP-05 record.

Nostr nsec

Your private key. Treat it exactly like the PVK. Anyone with the nsec can post as you forever.

Bitcoin Seed

The master secret for the derived wallet. Write it on paper or metal. Never photograph it, never type it into a website, never store it in a password manager that syncs to the cloud.

BTC Address

The bc1q… address is safe to share and receive to.

Account zpub

Lets a watch-only wallet track balances without holding spending keys. Still sensitive — anyone with the zpub can see your whole wallet history.

Workflow

• Use one alias per context (work, personal, pseudonymous) so a leak in one does not cascade.
• Write down the alias+password pair and store it separately from the derived secrets, or you will not be able to regenerate this identity.
• Verify a small transaction before trusting the Bitcoin derivation with meaningful funds.
• Cross-check the first address against a second, independent BIP84 implementation.