SQRL Login

Passwordless sign-in with SQRL (Secure Quick Reliable Login): one identity, a unique key per site, nothing to phish.

SQRL Login is a complete client for SQRL, the Secure Quick Reliable Login system designed by Steve Gibson of GRC. With SQRL you sign in to websites without usernames or passwords: your single identity derives a different cryptographic key for every site, the site stores only that site-specific public key, and signing in means signing a one-time challenge. There is nothing to remember per site, nothing to reuse, and nothing a phishing page can capture. What the extension does: • Signs you in to any SQRL-enabled website when you click its "Sign in with SQRL" link, including Client Provided Session (CPS), SQRL's protection against spoofed sites. • Creates your identity, protected by one password you choose and a 24-digit rescue code the extension generates for recovery. • Imports and exports identities in the standard SQRL formats (identity file, textual identity, QR code), so the same identity works in GRC's Windows client and the Android and iOS apps. • QuickPass: after the first login, just the first few characters of your password are needed; it is cleared on idle, lock or a wrong entry. • Lets you disable, re-enable or remove your SQRL access on a site, and re-key your identity, exactly as the SQRL specification describes. Built for trust: • All cryptography and protocol code is written in Rust and compiled to WebAssembly; the source is open (MIT) at https://github.com/danielpclark/SQRL-extension. • Verified against GRC's published specification and test vectors. • Nothing is ever sent anywhere except the SQRL protocol messages to the site you are signing in to. No accounts, no analytics, no servers of our own.