How Digi-ID works

Digi-ID is a way to sign in to a website with a DigiByte wallet instead of a password. There is nothing to remember, nothing for the site to store, nothing for an attacker to steal, and no password to phish. The whole login is a single cryptographic signature, and the key that makes it never leaves your phone.

The four steps

1. The site issues a challenge. When you open the login page, the server generates a random 16-byte nonce and wraps it in a digiid:// URI that points back at its own callback address. It shows that URI as a QR code, or as a tappable link on a phone, and starts waiting. The challenge is valid for five minutes and can be used exactly once.

2. Your wallet scans it. The wallet reads the URI, shows you which domain is asking, and checks that the callback really belongs to that domain and uses https. If anything is off, it refuses before touching a key.

3. Your wallet signs the URI. After you unlock with your PIN or fingerprint, the wallet signs the exact URI string using the same signed-message scheme DigiByte Core uses: the message is prefixed with DigiByte Signed Message:, hashed twice with SHA-256, and signed with your private key. The result is a 65-byte signature that anyone can check but nobody can forge. The wallet then posts three things to the site's callback: the URI, your address, and the signature.

4. The site verifies and lets you in. The server recovers your public key from the signature, derives the address it corresponds to, and checks that it matches the address the wallet claimed. It also checks that the URI is byte-for-byte the one it issued and that the nonce has not been used before. If all of that holds, you are signed in as the owner of that address. Your browser, which has been quietly polling, receives one session and the challenge is spent.

Why it is secure

No passwords. There is no password database to breach and no secret to type into a fake page. A signature is only valid for the exact site named in the URI, and the wallet shows you that domain before you approve.

What it does not stop by itself. A page you do not trust can show you a real site's login QR. If you scan it, your wallet correctly signs for the real domain, and the browser that requested that code, not yours, is the one signed in as you. Only scan a login code when the address bar of the page showing it matches the domain your wallet displays, and never scan a login QR someone sends you.

The key stays private. A signature proves you hold a private key without revealing it. The site learns your address and nothing else.

One challenge, one use. Every login uses a fresh random nonce, and the server marks it spent the moment a valid signature arrives. A captured signature is useless a second time.

No central identity provider. Nobody sits between you and the site. Your DigiByte address is your identity, and you can use a different key for every site if your wallet supports per-site identities.

What to use

The DigiByte Android wallet handles digiid:// links and QR codes, and it can sign in to DigiScope with one tap without any QR at all. On DigiScope, Digi-ID is one of three ways to sign in alongside X and Telegram; try it on the login page.

Build it yourself

Everything above is open. The server-side guide walks through DigiScope's own implementation, including the checks that make replay and tampering fail, and the wallet-side guide shows how the Android wallet parses, signs, and posts, with the code.