Moved to Saturday the 22nd, same room. Bring a friend.
— Marta Lanzoni · veil.pub/u/…
Your name, your keys, witnessed in public.
Veil ties your keys to the accounts people know you by. Anyone can find your key and check it, and a stolen account can’t speak as you.
Try
Coming from veil.rip? Move this browser
Got a signed message or file? Check it
Pick your name while it is free: veil.pub/u/yourname
What Veil is
Today a public key is a long string that looks like every other, lives in odd places, and nobody knows if it’s really yours.
Veil is a public register of cards. Each one ties a person’s keys to the accounts people know them by.
From an account
to the right key
Discord, GitHub, email, domain
From a key
to the person
SSH, PGP, a fingerprint, a signature
A stolen account
can’t sign
the keys stay in your browsers
Every change
in public
signed by the witnesses
How it works
It starts in your browser.
Open veil.pub and Veil makes a key right here, in this browser. The key stays there. It is never sent to us or to your other devices, and the only copy that ever leaves is your own encrypted backup. Each browser you use gets a key of its own.
Then you prove who you are.
Sign in once with each account you want on your card: Discord, GitHub, your email, your domain, the Fediverse. Veil then writes down that the account belongs to the person with these keys.
Every change is written down.
Each change, like adding a phone, linking an account or losing a device, becomes a new line in a public record. Lines can be added, but nobody can change or remove them, and that includes us.
Witnesses confirm it.
Within half a minute of every change, independent witnesses check the record and sign it. If we ever showed you a different card than everyone else sees, they would notice.
Witnessed by
Who confirmed each entry
signature verified in your browsernot signed yet
The live record at log.veil.pub, checked in your browser. See the live record
Logos belong to their operators.
One link proves it’s you.
Put veil.pub/u/… in a forum signature, a bio, a README or an email footer. Whoever clicks it sees your card, with your accounts and your keys, each one certified and checked in their own browser.
New date for the November meetup
Marta Lanzoni
Checked by the witnesses
- Discord marta.lnz
- GitHub mlanzoni
- Email marta@lanzoni.studio
- Domain lanzoni.studio
Fingerprint
- valve
- latin
- bag
- seminar
- student
- theory
- ready
- crazy
- trouble
- six
- trend
- dial
Signed means they really said it.
A Veil signature travels with the words. Whoever reads them looks the author up on Veil, gets their key and checks the signature against it, in their own browser.
New date for the November meetup
Moved to Saturday the 22nd, same room. Bring a friend.
Signed by Marta Lanzoni · veil.pub/u/… · 402c 0a0a … dec4
Checking the signature…
FromMarta Lanzoni <marta@lanzoni.studio>
Toluca@bottega-arno.it
SubjectOctober invoice
Looking up marta@lanzoni.studio on Veil…
Hi Luca, the October invoice is attached. Please pay to the usual account: nothing has changed. — Marta
The address was looked up on Veil, its key fetched and the signature checked. Marta wrote this, not someone who has her password.
No password, token or account can produce this signature. Only Marta’s own key can, and that key lives in her browser.
Bring your public keys.
Add the public half of the keys you already use: SSH, PGP, minisign or ML-DSA. The private key never leaves your machine, and Veil never asks for it. You prove the key is yours by signing one challenge with it, and anyone can check that proof on your card.
$ cat ~/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI… marta@laptop
$ ssh-keygen -Y sign -n veil -f ~/.ssh/id_ed25519 veil-challenge.txt
Signing file veil-challenge.txt
Write signature to veil-challenge.txt.sigSearch its fingerprint on Veil and you land on Marta’s card: SHA256:…
Three steps, five minutes
Open.
Open veil.pub in the browser you already use. There is nothing to install and no password to choose.
veil.pub
Your name, your keys, witnessed in public.
Create.
Choose the name people will see, and your browser makes your first key. Then you export that key to an encrypted backup file.
- Active
This browser
Key created here
Download your backup
veil-backup-u42.json encrypted
Passphrase
suggested by Veil
Keep it anywhere: a USB stick, your cloud drive, an email to yourself. Only your passphrase opens it.
Link.
Link the accounts people know you by. Each one is a signed line on your card. From then on, anyone who knows you by one of them can find your key, and anyone who has your key can find you. From your card’s page on veil.pub.
Add an account
- Discord
- GitHub
- Domain
- Fediverse
Common questions
How do I find someone’s key? Search for any account they’ve linked, such as a Discord name, a GitHub username, an email or a domain. Veil shows their card and checks it in your browser. It works the other way round too. Paste a key or a fingerprint, SSH and PGP ones included, and Veil shows you whose it is.
Can I check who signed something? Yes. Open its verify link, or paste the signed text with its two lines underneath at veil.pub/verify. For a signed file or release, drop the file there with its signature; the file never leaves your computer. Your browser finds the card that holds the key and checks whether that key was valid.
How do I sign something? Paste the text into your Veil card. You get a signature block to put under a post, a message or an email, plus a verify link. Anyone can check the signature against your card.
Why not just share my key? Keys are long, they look alike and they get copied wrong. A card ties your key to accounts people already know and proves the tie. Share your Veil link instead. It carries your keys and your accounts, all certified.
Which accounts can I link? Those this server can prove, from your card’s page. The proof is a sign-in, a DNS record or a link back from your profile, never a password. Link yours
How do I show Veil on my site or profile? Paste your card’s link wherever you post, and chat apps will show its preview. For a README or a forum signature there is a badge, and for your site a widget that checks your card in each visitor’s browser. The snippets are here
Is Veil a password manager? Can you read my messages? No to both. Veil keeps no secrets, no messages and no private keys. All it holds is your public card.
Do I need to install anything, or understand cryptography? No. Veil runs in your browser, and the browser keeps your key where no web page can read it. All you need is a browser and a backup file.
What if I lose my laptop or phone? Open Veil in another browser you’ve used and remove the lost one. From that moment its key no longer counts. If you have no other browser, your backup file brings you back.
What is the backup file? It is your key, exported from the browser into a file that only your passphrase can open. Keep it anywhere you like. When every browser is gone, it is the only thing that can bring you back.
What if one of my accounts gets stolen? The thief can log in to that account, but they can’t sign as you, because the keys are in your browsers. If they try to move the account onto a card of their own, you get seven days to say no.
Who are the witnesses? Independent organisations and people. They check and sign our record within half a minute of every change, and none of them works for us.
What can everyone see? Your name, your links and your public keys, which is what you chose to put on the card. Never a private key, and never a message.
Can I delete my card? Yes. The card and its details are removed. The record keeps only unreadable digits that point to nothing.
What does it cost? Nothing for people. Organisations pay for verified domains and member management.
Is it safe against quantum computers? Yes. Every change on your card is signed with a post-quantum signature as well as a classical one, and the public record only uses hashes, which quantum computers don’t threaten.