Name
A display name visible to others. Not used for cryptography.
Visibility
Public to your contacts.
Sign in
uOS workspace
Open your private workspace.
Authentication happens entirely in your browser. Three secrets are turned into cryptographic keys on your device — nothing is sent to the server, and there is no password database.
Not invited yet? Request an invite.
01
Identity
Three secrets. No password database.
Instead of a password, you sign in with three secrets that only you know. The browser derives your cryptographic keys on the device. The server stores public keys only.
Phrase
A long memorable phrase that contributes entropy to your keys.
Visibility
Private — never leaves your device.
Used for invitations and recovery keys. Never leaves your device.
Visibility
Private — stored locally, not on server.
02
Security guarantees
How your data stays yours.
Browser storage is wiped on every page load
Session state exists in RAM only. localStorage and sessionStorage are not used for the authenticated session.
Private keys never leave your device
They live only in volatile memory and are discarded the moment you close the tab.
Why this matters
A compromised server cannot extract your keys because the server never had them.
3-of-5 recovery
UltimaOS gives you five key-files when you join; any three together reconstruct your account. No recovery custodian in the middle.
Why this matters
No single person, not even UltimaOS, can unilaterally recover your account.
Cryptography: NIST FIPS 203 (ML-KEM-768) · FIPS 204 (ML-DSA-65) · RFC 8439 (XChaCha20-Poly1305)