CryptoLogin is a passwordless authentication system where the server stores
zero secrets.
No password hashes. No emails. No recovery tokens.
Just a user_id derived from your master_secret,
and authentication proven cryptographically via HMAC.
# Zero-Storage Authentication in 3 lines
from cryptologin import CryptoLogin
auth = CryptoLogin()
user_id = auth.register("my-secret")
# That's it. The server stores nothing.
# No hashes. No emails. No passwords.One secret to remember. No more forgotten passwords, no more lost emails, no more password managers.
Your secret never leaves your device. The server knows nothing about it. Zero-knowledge inspired.
A system that respects your data. No trackers, no third-party dependencies, no vendor lock-in.
"PoetryCoding™ — It is not a method. It is an approach. Code as you would write poetry: with restraint, with care."— erabytse, founder of the PoetryCoding movement
The server never stores your secret. Only a derived user_id and temporary challenges.
Done with spam, verifications, and lost passwords. Your identity is your secret.
Just one secret for your entire digital life. Derived locally via PBKDF2-SHA512.
Built on hashlib, hmac, and Web Crypto API. No custom cryptography.
HMAC-SHA256 verification (~1ms). 3 API endpoints. 2 SDKs (Python + JavaScript).
MIT License. Run it on your own infrastructure. No vendor lock-in, no SaaS dependency.
100,000 iterations for key derivation. Memory-hard, resistant to GPU attacks.
NIST SP 800-132Challenge-response authentication. Constant-time comparison to prevent timing attacks.
RFC 2104The master_secret never leaves the client. The server only knows a derived user_id.
If the database is leaked, there's nothing to exploit. No hashes, no emails, no secrets.
Nothing to steal| Feature | CryptoLogin | Auth0 | Firebase | Clerk |
|---|---|---|---|---|
| Zero-Storage Auth | ✅ | ❌ | ❌ | ❌ |
| No Email Required | ✅ | ❌ | ❌ | ❌ |
| No Password Storage | ✅ | ❌ | ❌ | ❌ |
| Open Source | ✅ | ❌ | ❌ | ❌ |
| Self-Hosting | ✅ | ❌ | ❌ | ❌ |
| Standard Primitives | ✅ | ⚠️ | ⚠️ | ⚠️ |
| Price | 💰 Free | 💰💰💰 | 💰💰 | 💰💰💰 |
Create an account in 2 seconds. One master secret. No personal data.
💡 How does it work?
Your secret is used to encrypt your data locally. The server only receives a challenge that only you can decrypt. This is the magic of Passwordless Authentication without Password Storage.
The master secret never leaves your browser. Authentication proven via HMAC.
How it works (V2 - Real Flow)
1. Your secret is used locally to derive a user_id (via Web Crypto API).
2. The server only sees the user_id and generates a random challenge.
3. Your browser computes HMAC-SHA256(challenge, user_id).
4. The server verifies the HMAC without knowing your secret.
The master secret NEVER leaves your browser.