Documentation
Everything about Digi-ID, in one place.
Frequently asked questions, what vendors need to know and how the security model works. Building an integration? The protocol reference lives in the developer hub.
One-page overview (PDF)FAQ for users
What is Digi-ID?
Digi-ID lets you sign in to a website, app or location using a QR code. The service must support Digi-ID before you can use it there. It uses cryptography — the same type of mathematics used to secure DigiByte — to verify your sign-in. Digi-ID can replace a username and password or be used alongside them.
Why use Digi-ID?
When Digi-ID replaces your password, it removes several common password risks:
- No password to remember, write down or share.
- No sign-in password for the website to store or an attacker to steal or guess.
- No password reuse across accounts.
- No password to capture with keystroke-recording software.
How does sign-in work?
- The service displays a unique QR code for your sign-in request. It includes a one-time value and tells your Digi-ID app where to send its response.
- Scan or tap the code and confirm the request in your Digi-ID app.
- The app uses your private key to create a digital signature, then sends the signed response and your public login address to the service.
- The service verifies the signature and login address, then signs you in.
Why don't I need a username or password?
Your public login address identifies you to the service, while the digital signature proves you control the matching private key.
Could someone guess my login?
Digi-ID uses cryptographic keys instead of passwords. These keys are designed to make guessing impractical.
Is signing in on a shared computer safe?
Digi-ID avoids typing a website password on that computer. It does not make the computer safe; an attacker could still capture the active session or data shown in the browser. Sign out when you're finished.
Could someone trick me into signing them in?
Yes. If you approve a code presented by someone else, they may gain the session. Only approve Digi-ID codes on pages you opened yourself, and check the site name your wallet shows. Be careful with codes sent in messages, shown by another person or reached through an unexpected link.
What if I lose my phone?
If you backed up your recovery phrase, you can restore your Digi-ID identity in a compatible app on another device. If you lose the recovery phrase as well, that Digi-ID identity cannot be restored — keep it somewhere safe and offline. There is no password reset and no support team holding a copy. Individual websites may still let you prove who you are another way and set up a new Digi-ID identity for your account.
Can I use Digi-ID on more than one device?
Yes. Restore the same recovery phrase on another compatible device to use the same identity. A device with a new recovery phrase creates a separate identity, and websites will treat it as a different user.
Can a website see my DigiByte balance?
No. Digi-ID uses a login address separate from your wallet's receiving addresses and generates a different login address for each website. Do not send DigiByte to a Digi-ID login address — funds sent there will not appear in your wallet.
What personal information does Digi-ID share?
None beyond your public login address and a signed response. Each request includes a “nonce”, an unpredictable value that identifies that specific request (for example x=458c552d84a8a347). It does not include your name or any other personal details.
Who do I contact for help?
For account-specific problems, contact the website or service where you're signing in — no DigiByte channel can help with an individual website's accounts. For questions about Digi-ID itself, see the community page.
For vendors
Digi-ID is an authentication method based on the security of the DigiByte blockchain. Users sign in to a website, application, building and more by scanning or tapping a QR code. It can replace usernames and passwords or complement them.
What's involved in integrating Digi-ID?
It depends on your stack. Where a plugin exists, you can be running in minutes. Otherwise, use one of the libraries and the quickstart; a typical web integration is one challenge endpoint, one callback endpoint and a QR code on the login page.
What are the security benefits for me and my users?
Digi-ID can be an additional layer alongside username and password, or — as users add Digi-ID — replace passwords entirely. Without passwords, users can't reuse or choose weak ones, and a breach elsewhere leaves no credentials for an attacker to obtain. Users are also protected from password reuse on other sites.
How does my product work without passwords?
Show a Digi-ID QR code to tap or scan instead of a login form. Sign-in is faster than typing credentials, and users can sign in on a shared computer without their details being saved. Each challenge is valid for one session only, so a response can't be replayed later. This means:
- Users prove they are “me” without any personally identifiable information.
- The weakest point of authentication — usernames and passwords — is removed.
- Sharing credentials becomes far more difficult.
- Users with several accounts (for example home and work) no longer juggle credentials.
How do I contact users without a username?
Once users are signed in you can still ask for an email address or name, just as you do today — for example to ship a product or send receipts. Digi-ID is pseudonymous: the only identifying information is what users choose to give you after authenticating.
Integrator FAQ
Read the integration guide (PDF)
What is a good nonce timeout?
About 90 seconds for most websites, shorter for doors and kiosks. See Nonces & Replay Prevention.
Do I need the DigiByte “D” in the QR code?
No, it's optional. Label the code “Sign in with Digi-ID” so users know what they're scanning.
Do I need to run a DigiByte node?
No. The libraries verify signatures locally, with no connection to the DigiByte blockchain or any third-party service.
Does it work offline or on a local network?
Yes, as long as the wallet can reach the callback URL (for example over local Wi-Fi) and the callback is served over HTTPS.
How can Digi-ID be used for building access?
Put a screen that shows a fresh QR code at each door. Use one callback URL for all doors and record which door issued each nonce — separate callback paths would give each person a different address per door. When a user scans and approves, your access server verifies the signature, checks the address against that door's allow-list and unlocks it. See the door-access guide.
Why do users get different addresses on different sites?
Wallets derive a separate key for every callback URL, so sites can't correlate users. Keep your callback URL stable — changing it gives every user a new address.
Can Digi-ID be added to a third-party wallet?
Yes. The key derivation and test vector in the protocol reference are all you need.
Security model
Digi-ID is challenge–response authentication with public-key cryptography, the same idea as keyless SSH.
| Threat | How Digi-ID handles it |
|---|---|
| Database breach | Services store only public addresses. There is no secret to crack or reuse. |
| Credential stuffing & reuse | Every site gets its own derived key, so nothing carries over between sites. |
| Replay | Each challenge has a fresh nonce that expires quickly and is consumed on first use. |
| Phishing sites | Signatures and keys are bound to the callback domain; the wallet shows which site is asking. Users must still check it. |
| Session hijack via shown QR code | Only approve codes on pages you opened yourself; services should keep challenges short-lived. |
| Lost device | Restore from the recovery phrase; services should allow linking a second wallet. |
| Transport interception | Callbacks must use HTTPS; u=1 (plain HTTP) is for local development only. |
Found a security issue in this site, the demo or digiid-core? Please report it privately through GitHub security advisories.