Signing in

An account is a key, not a password

Making an account generates an identity key pair in your browser. Signing in means the server sends a challenge and your device signs it. The server stores your public key; it has never had the private one.

That is why a passphrase alone cannot get you in from a device that has never held your keys — and why nobody, including the operator, can read your messages by resetting anything.

Making an account also gives you a personal key — a second keypair, the one the rest of the world reads as an SSH or GPG key — made in the same breath and published as soon as your keystore is open (0.1.155). You do not have to ask for it or know it exists. It is what lifts a conversation to the top encryption tier, and it is why two ordinary accounts here start there rather than working their way up to it.

The passphrase

The passphrase seals your keys on this device. It is stretched with PBKDF2 at 600,000 iterations before it is used, which is what makes a stolen device's keystore expensive to attack rather than trivial.

How long it has to be is set by the operator. The check happens in your browser, because the server never sees the passphrase to check it, and it is also compared against a list of the commonest passwords.

Forgetting it, with no other device signed in, means the keys are gone. Not "gone until an administrator resets them" — gone. Everything sent to those keys stays unreadable by everybody, forever. That is the cost of the server not being able to read anything, and it is the one thing about Yeetline worth telling a new person on their first day.

Signing in on a second device

If keystore sync is on, a copy of your keys — sealed with your passphrase — is kept on the server, so a new device can fetch it and open it locally. The server holds only a hash of a verifier, derived under a different label from the key itself, so it can check that you know the passphrase without ever being able to open the blob or work the passphrase out from what it stores.

If sync is off, a new device needs an existing one to bring it in.

Passkeys and security keys

A passkey signs you in with a touch and no typing, and can carry the sealed passphrase so your keys open with nothing typed either. A hardware security key does the same and never leaves the device it lives on.

Both are offered only where this server has them switched on. A passkey is bound to a domain — if the server later moves to a different hostname, a passkey registered under the old one stops working, and you sign in with your passphrase and register a new one.

Second factors

Where this server asks for one, it may be an authenticator app (a six-digit code), a security key, a code by email, or one of your recovery codes. "Trust this device" skips it for a while — how long is the operator's setting.

Keep the recovery codes somewhere that is not the device you sign in with.

Devices

Each browser or app is its own device with its own session keys. You can see your devices, rename them and revoke any of them from your own row in the app. Revoking one takes it out immediately.

Adding a device does not let it read messages sent before it existed: the sender sealed those to the devices that were there at the time.

Guests

If the operator allows it, you can come in as a guest: one tap, a throwaway account, a name of your choosing, no password. While you are here you are an ordinary user, bound by whatever the Guest role allows.

A guest account and everything it wrote is deleted the moment its last connection goes. Guests cannot become staff and cannot enrol a second factor. If you want to keep anything, register.

Last changed 2026-09-12